Adaptive Real-Time Anomaly Detection with Improved Index and Ability to Forget

Anomaly detection in IP networks, detection of deviations from what is considered normal, is an important complement to misuse detection based on known attack descriptions. Performing anomaly detection in real-time places hard requirements on the algorithms used. First, to deal with the massive data volumes one needs to have efficient data structures and indexing mechanisms. Secondly, the dynamic nature of today’s information networks makes the characterization of normal requests and services difficult. What is considered as normal during some time interval may be classified as abnormal in a new context, and vice versa. These factors make many proposed data mining techniques less suitable for real-time intrusion detection. In this paper we extend ADWICE, Anomaly Detection With fast Incremental Clustering. Accuracy of ADWICE classifications is improved by introducing a new grid-based index, and its ability to build models incrementally is extended by introducing forgetting. We ev...

• Type: Conference
• Year: 2005
• Where: ICDCSW
• Authors: Kalle Burbeck, Simin Nadjm-Tehrani
• Keywords: Anomaly Detection, Distributed And Parallel Computing, ICDCSW 2005, Misuse Detection, Real-time Intrusion Detection