scholarly journals Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection

Sensors ◽  
2021 ◽  
Vol 21 (22) ◽  
pp. 7464
Author(s):  
Jianhua Yang ◽  
Lixin Wang
Keyword(s):  
Data Mining ◽  
Intrusion Detection ◽  
Network Traffic ◽  
Local Area ◽  
Step Function ◽  
Data Mining Algorithm ◽  
Round Trip ◽  
Matching Algorithm ◽  
Stepping Stone ◽  
Trip Time

A long interactive TCP connection chain has been widely used by attackers to launch their attacks and thus avoid detection. The longer a connection chain, the higher the probability the chain is exploited by attackers. Round-trip Time (RTT) can represent the length of a connection chain. In order to obtain the RTTs from the sniffed Send and Echo packets in a connection chain, matching the Sends and Echoes is required. In this paper, we first model a network traffic as the collection of RTTs and present the rationale of using the RTTs of a connection chain to represent the length of the chain. Second, we propose applying MMD data mining algorithm to match TCP Send and Echo packets collected from a connection. We found that the MMD data mining packet-matching algorithm outperforms all the existing packet-matching algorithms in terms of packet-matching rate including sequence number-based algorithm, Yang’s approach, Step-function, Packet-matching conservative algorithm and packet-matching greedy algorithm. The experimental results from our local area networks showed that the packet-matching accuracy of the MMD algorithm is 100%. The average packet-matching rate of the MMD algorithm obtained from the experiments conducted under the Internet context can reach around 94%. The MMD data mining packet-matching algorithm can fix the issue of low packet-matching rate faced by all the existing packet-matching algorithms including the state-of-the-art algorithm. It is applicable to network-based stepping-stone intrusion detection.

CLUSTERING-BASED NETWORK INTRUSION DETECTION

2007 ◽  
Vol 14 (02) ◽  
pp. 169-187 ◽  
Author(s):  
SHI ZHONG ◽  
TAGHI M. KHOSHGOFTAAR ◽  
NAEEM SELIYA
Keyword(s):  
Data Mining ◽  
Network Security ◽  
Intrusion Detection ◽  
Unsupervised Learning ◽  
Network Traffic ◽  
Clustering Algorithms ◽  
Network Intrusion Detection ◽  
Learning Methods ◽  
High Detection Rate ◽  
Network Intrusion

Recently data mining methods have gained importance in addressing network security issues, including network intrusion detection — a challenging task in network security. Intrusion detection systems aim to identify attacks with a high detection rate and a low false alarm rate. Classification-based data mining models for intrusion detection are often ineffective in dealing with dynamic changes in intrusion patterns and characteristics. Consequently, unsupervised learning methods have been given a closer look for network intrusion detection. We investigate multiple centroid-based unsupervised clustering algorithms for intrusion detection, and propose a simple yet effective self-labeling heuristic for detecting attack and normal clusters of network traffic audit data. The clustering algorithms investigated include, k-means, Mixture-Of-Spherical Gaussians, Self-Organizing Map, and Neural-Gas. The network traffic datasets provided by the DARPA 1998 offline intrusion detection project are used in our empirical investigation, which demonstrates the feasibility and promise of unsupervised learning methods for network intrusion detection. In addition, a comparative analysis shows the advantage of clustering-based methods over supervised classification techniques in identifying new or unseen attack types.

A New Model of Intrusion Detection Based on Data Warehouse and Data Mining

2011 ◽  
Vol 383-390 ◽  
pp. 303-307 ◽  
Author(s):  
Bei Qi ◽  
Yun Feng Dong
Keyword(s):  
Data Mining ◽  
Intrusion Detection ◽  
Data Warehouse ◽  
Network Traffic ◽  
Traffic Monitoring ◽  
Experimental Result ◽  
Double Layers ◽  
New Model ◽  
Network Intrusion ◽  
Security Of Network

Now, security of network is threaten from double layers inside and outside network, the inherent defect of firewall technology makes the intrusion detection and network traffic analysis as the main means of defense, aiding firewall. Now network intrusion detection have problem of higher false alarm rate, we apply the data warehouse and the data mining in intrusion detection and the technology of network traffic monitoring and analysis, propose a new model of intrusion detection based on the data warehouse and the data mining. The experimental result indicates this model can find effectively many kinds behavior of network intrusion and have higher intelligence and environment accommodation.

Sign in / Sign up

Export Citation Format

Share Document