Sciweavers

Share
ICDCSW
2005
IEEE

Adaptive Real-Time Anomaly Detection with Improved Index and Ability to Forget

10 years 8 months ago
Adaptive Real-Time Anomaly Detection with Improved Index and Ability to Forget
Anomaly detection in IP networks, detection of deviations from what is considered normal, is an important complement to misuse detection based on known attack descriptions. Performing anomaly detection in real-time places hard requirements on the algorithms used. First, to deal with the massive data volumes one needs to have efficient data structures and indexing mechanisms. Secondly, the dynamic nature of today’s information networks makes the characterization of normal requests and services difficult. What is considered as normal during some time interval may be classified as abnormal in a new context, and vice versa. These factors make many proposed data mining techniques less suitable for real-time intrusion detection. In this paper we extend ADWICE, Anomaly Detection With fast Incremental Clustering. Accuracy of ADWICE classifications is improved by introducing a new grid-based index, and its ability to build models incrementally is extended by introducing forgetting. We ev...
Kalle Burbeck, Simin Nadjm-Tehrani
Added 24 Jun 2010
Updated 24 Jun 2010
Type Conference
Year 2005
Where ICDCSW
Authors Kalle Burbeck, Simin Nadjm-Tehrani
Comments (0)
books