| IEICE Technical Committee Submission System Conference Paper's Information |
Online Proceedings [Sign in] Tech. Rep. Archives |
| Go Top Page | Go Previous | [Japanese] / [English] |
| Paper Abstract and Keywords | ||
| Presentation | 2013-03-14 10:40 A Study of the Anomaly Detection Method Characteristics based on the Traffic Parameter Clustering Kouhei Tatsumi, Toyokazu Akiyama (Kyoto Sangyo Univ.)  SITE2012-49 IA2012-87 |
|
| Abstract | (in Japanese) | (See Japanese page) |
| (in English) | The ”targeted attacks” especially to the government and the companies increase in recent years. Such unknown attacks are difficult to detect by signature-based IDSs, and it is said that anomaly-based IDS can detect them effectively. In this study, we investigated the applicability of an existing anomaly detection method to the practical environment. The method is classified to the anomaly-based method and it uses the degree of deviation from the normal state. In the method, at first, the features of the normal state is extracted by clustering normal traffic parameters using k-means method. Then, it calculates the degree of deviation from the normal state for the newly observed traffic. We implemented the method using the R and Ruby. Then, we apply it to detect anomalies using the 1999 Darpa Intrusion Detection Data Set. Since the k-means method requires the number of clusters decide before clustering, the existing method uses the parameter R(k)to find the approproate number. The literature, describes that R(k) will converge when the number of the cluster k increases, and k will be the optimal when R(k) is within of the converged value. However, R(k) did not converge with the Data set. Therefore, we will compare the fixed k value used in the existing methods and the x-means method which automatically determines the appropriate k value. |
|
| Keyword | (in Japanese) | (See Japanese page) |
| (in English) | anomaly detection / clustering / / / / / / | |
| Reference Info. | IEICE Tech. Rep., vol. 112, no. 489, IA2012-87, pp. 25-30, March 2013. | |
| Paper # | IA2012-87 | |
| Date of Issue | 2013-03-07 (SITE, IA) | |
| ISSN | Print edition: ISSN 0913-5685 Online edition: ISSN 2432-6380 | |
| Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) | |
| Download PDF | SITE2012-49 IA2012-87 |
|
| Conference Information | |
| Committee | IA SITE IPSJ-IOT |
| Conference Date | 2013-03-14 - 2013-03-15 |
| Place (in Japanese) | (See Japanese page) |
| Place (in English) | Todaiji Total Cultural Center |
| Topics (in Japanese) | (See Japanese page) |
| Topics (in English) | Internet and Information Ethics Education, etc. |
| Paper Information | |
| Registration To | IA |
| Conference Code | 2013-03-IA-SITE-IOT |
| Language | Japanese |
| Title (in Japanese) | (See Japanese page) |
| Sub Title (in Japanese) | (See Japanese page) |
| Title (in English) | A Study of the Anomaly Detection Method Characteristics based on the Traffic Parameter Clustering |
| Sub Title (in English) | |
| Keyword(1) | anomaly detection |
| Keyword(2) | clustering |
| Keyword(3) | |
| Keyword(4) | |
| Keyword(5) | |
| Keyword(6) | |
| Keyword(7) | |
| Keyword(8) | |
| 1st Author's Name | Kouhei Tatsumi |
| 1st Author's Affiliation | Kyoto Sangyo University (Kyoto Sangyo Univ.) |
| 2nd Author's Name | Toyokazu Akiyama |
| 2nd Author's Affiliation | Kyoto Sangyo University (Kyoto Sangyo Univ.) |
| 3rd Author's Name | |
| 3rd Author's Affiliation | () |
| 4th Author's Name | |
| 4th Author's Affiliation | () |
| 5th Author's Name | |
| 5th Author's Affiliation | () |
| 6th Author's Name | |
| 6th Author's Affiliation | () |
| 7th Author's Name | |
| 7th Author's Affiliation | () |
| 8th Author's Name | |
| 8th Author's Affiliation | () |
| 9th Author's Name | |
| 9th Author's Affiliation | () |
| 10th Author's Name | |
| 10th Author's Affiliation | () |
| 11th Author's Name | |
| 11th Author's Affiliation | () |
| 12th Author's Name | |
| 12th Author's Affiliation | () |
| 13th Author's Name | |
| 13th Author's Affiliation | () |
| 14th Author's Name | |
| 14th Author's Affiliation | () |
| 15th Author's Name | |
| 15th Author's Affiliation | () |
| 16th Author's Name | |
| 16th Author's Affiliation | () |
| 17th Author's Name | |
| 17th Author's Affiliation | () |
| 18th Author's Name | |
| 18th Author's Affiliation | () |
| Speaker | Author-1 |
| Date Time | 2013-03-14 10:40:00 |
| Presentation Time | 25 minutes |
| Registration for | IA |
| Paper # | SITE2012-49, IA2012-87 |
| Volume (vol) | vol.112 |
| Number (no) | no.488(SITE), no.489(IA) |
| Page | pp.25-30 |
| #Pages | 6 |
| Date of Issue | 2013-03-07 (SITE, IA) |
[Return to Top Page]