Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

Jungsuk SONG  Hiroki TAKAKURA  Yasuo OKABE  Yongjin KWON  

IEICE TRANSACTIONS on Communications   Vol.E92-B   No.6   pp.1981-1990
Publication Date: 2009/06/01
Online ISSN: 1745-1345
DOI: 10.1587/transcom.E92.B.1981
Print ISSN: 0916-8516
Type of Manuscript: PAPER
Category: Fundamental Theories for Communications
intrusion detection system,  clustering,  one-class SVM,  anomaly detection,  

Full Text: PDF(456.5KB)>>
Buy this Article

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.