Optimized clustering for anomaly intrusion detection

Sang Hyun Oh; Won Suk Lee

doi:10.1007/3-540-36175-8_57

Optimized clustering for anomaly intrusion detection

Sang Hyun Oh, Won Suk Lee

College of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

4 Citations (Scopus)

Abstract

Although conventional clustering algorithms have been used to classify data objects in a data set into the groups of similar data objects based on data similarity, they can be employed to extract the common knowledge i.e. properties of similar data objects commonly appearing in a set of transactions. The common knowledge of the activities in the transactions of a user is represented by the occurrence frequency of similar activities by the unit of a transaction as well as the repetitive ratio of similar activities in each transaction. This paper proposes an optimized clustering method for modeling the normal pattern of a user's activities. Furthermore, it also addresses how to determine the optimal values of clustering parameters for a user as well as how to maintain identified common knowledge as a concise profile. As a result, it can be used to detect any anomalous behavior in an online transaction of the user.

Original language	English
Title of host publication	Advances in Knowledge Discovery and Data Mining
Editors	Kyu-Young Wang, Jongwoo Jeon, Kyuseok Shim, Jaideep Srivastava
Publisher	Springer Verlag
Pages	576-581
Number of pages	6
ISBN (Electronic)	3540047603, 9783540047605
DOIs	https://doi.org/10.1007/3-540-36175-8_57
Publication status	Published - 2003
Event	7th Pacific-Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2003 - Seoul, Korea, Republic of Duration: 2003 Apr 30 → 2003 May 2

Publication series

Name	Lecture Notes in Artificial Intelligence (Subseries of Lecture Notes in Computer Science)
Volume	2637
ISSN (Print)	0302-9743

Other

Other	7th Pacific-Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2003
Country/Territory	Korea, Republic of
City	Seoul
Period	03/4/30 → 03/5/2

Bibliographical note

Publisher Copyright:
© Springer-Verlag Berlin Heidelberg 2003.

All Science Journal Classification (ASJC) codes

Theoretical Computer Science
Computer Science(all)

Access to Document

10.1007/3-540-36175-8_57

Cite this

@inproceedings{91ed8951e5a3457cac5a18deaa4036b4,

title = "Optimized clustering for anomaly intrusion detection",

abstract = "Although conventional clustering algorithms have been used to classify data objects in a data set into the groups of similar data objects based on data similarity, they can be employed to extract the common knowledge i.e. properties of similar data objects commonly appearing in a set of transactions. The common knowledge of the activities in the transactions of a user is represented by the occurrence frequency of similar activities by the unit of a transaction as well as the repetitive ratio of similar activities in each transaction. This paper proposes an optimized clustering method for modeling the normal pattern of a user's activities. Furthermore, it also addresses how to determine the optimal values of clustering parameters for a user as well as how to maintain identified common knowledge as a concise profile. As a result, it can be used to detect any anomalous behavior in an online transaction of the user.",

author = "Oh, {Sang Hyun} and Lee, {Won Suk}",

note = "Publisher Copyright: {\textcopyright} Springer-Verlag Berlin Heidelberg 2003.; 7th Pacific-Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2003 ; Conference date: 30-04-2003 Through 02-05-2003",

year = "2003",

doi = "10.1007/3-540-36175-8_57",

language = "English",

series = "Lecture Notes in Artificial Intelligence (Subseries of Lecture Notes in Computer Science)",

publisher = "Springer Verlag",

pages = "576--581",

editor = "Kyu-Young Wang and Jongwoo Jeon and Kyuseok Shim and Jaideep Srivastava",

booktitle = "Advances in Knowledge Discovery and Data Mining",

address = "Germany",

}

Oh, SH & Lee, WS 2003, Optimized clustering for anomaly intrusion detection. in K-Y Wang, J Jeon, K Shim & J Srivastava (eds), Advances in Knowledge Discovery and Data Mining. Lecture Notes in Artificial Intelligence (Subseries of Lecture Notes in Computer Science), vol. 2637, Springer Verlag, pp. 576-581, 7th Pacific-Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2003, Seoul, Korea, Republic of, 03/4/30. https://doi.org/10.1007/3-540-36175-8_57

Optimized clustering for anomaly intrusion detection. / Oh, Sang Hyun; Lee, Won Suk.
Advances in Knowledge Discovery and Data Mining. ed. / Kyu-Young Wang; Jongwoo Jeon; Kyuseok Shim; Jaideep Srivastava. Springer Verlag, 2003. p. 576-581 (Lecture Notes in Artificial Intelligence (Subseries of Lecture Notes in Computer Science); Vol. 2637).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Optimized clustering for anomaly intrusion detection

AU - Oh, Sang Hyun

AU - Lee, Won Suk

N1 - Publisher Copyright: © Springer-Verlag Berlin Heidelberg 2003.

PY - 2003

Y1 - 2003

N2 - Although conventional clustering algorithms have been used to classify data objects in a data set into the groups of similar data objects based on data similarity, they can be employed to extract the common knowledge i.e. properties of similar data objects commonly appearing in a set of transactions. The common knowledge of the activities in the transactions of a user is represented by the occurrence frequency of similar activities by the unit of a transaction as well as the repetitive ratio of similar activities in each transaction. This paper proposes an optimized clustering method for modeling the normal pattern of a user's activities. Furthermore, it also addresses how to determine the optimal values of clustering parameters for a user as well as how to maintain identified common knowledge as a concise profile. As a result, it can be used to detect any anomalous behavior in an online transaction of the user.

AB - Although conventional clustering algorithms have been used to classify data objects in a data set into the groups of similar data objects based on data similarity, they can be employed to extract the common knowledge i.e. properties of similar data objects commonly appearing in a set of transactions. The common knowledge of the activities in the transactions of a user is represented by the occurrence frequency of similar activities by the unit of a transaction as well as the repetitive ratio of similar activities in each transaction. This paper proposes an optimized clustering method for modeling the normal pattern of a user's activities. Furthermore, it also addresses how to determine the optimal values of clustering parameters for a user as well as how to maintain identified common knowledge as a concise profile. As a result, it can be used to detect any anomalous behavior in an online transaction of the user.

UR - http://www.scopus.com/inward/record.url?scp=7444249623&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=7444249623&partnerID=8YFLogxK

U2 - 10.1007/3-540-36175-8_57

DO - 10.1007/3-540-36175-8_57

M3 - Conference contribution

AN - SCOPUS:7444249623

T3 - Lecture Notes in Artificial Intelligence (Subseries of Lecture Notes in Computer Science)

SP - 576

EP - 581

BT - Advances in Knowledge Discovery and Data Mining

A2 - Wang, Kyu-Young

A2 - Jeon, Jongwoo

A2 - Shim, Kyuseok

A2 - Srivastava, Jaideep

PB - Springer Verlag

T2 - 7th Pacific-Asia Conference on Knowledge Discovery and Data Mining, PAKDD 2003

Y2 - 30 April 2003 through 2 May 2003

ER -

Optimized clustering for anomaly intrusion detection

Abstract

Publication series

Other

Bibliographical note

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this