Unsupervised Anomaly Detection in Network Intrusion Detection Using Clusters

By Kingsly Leung, Christopher Leckie. Australasian Computer Science Conference, 2005

428 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/3acadbcb91bd4c8ce1b375d31a20a6067be74937

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data (2016, methodology): “to use HTTP traffic only (similar to [37]) and also limit DoS traffic from the dataset (similar to [69]).”
Classifier ensembles: Select real-world applications (2008, background): “Part of the problem is that many of the anomaly detection systems devised in the literature are monolithic models that are designed to cover all protocols and services offered by the computer system and network [86,69,29].”
A survey of network anomaly detection techniques (2016, methodology): “Using this assumption, Leung and Leckie (2005) proposed a density-and grid-based clustering algorithm which is suitable for unsupervised anomaly detection.”
A detailed analysis of the KDD CUP 99 data set (2009, background): “Similarly, same problem with smurf and neptune attacks in the KDD training data set is reported in [15].”
MTH-IDS: A Multitiered Hybrid Intrusion Detection System for Internet of Vehicles (2021, background): “On the other hand, anomaly-based IDSs can distinguish unknown attack data from normal data by unsupervised learning algorithms based on the assumption that new attack data are more statistically similar to the known attack data than normal data, but they often return many false alarms [57].”
Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection (2006, methodology): “It detects attacks by determining unusual activities from data under two assumptions [9]:”
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection (2016, methodology): “An example of this approach for cyber is described in [47].”
Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges (2017, methodology): “based on density and grid-based clustering to accurately classify the high-dimensional dataset in a set of clusters; those points which do not fall in any cluster are marked as abnormal [71].”