Intrusion Detection System with k-means data mining and outlier detection approach

Mgr. Sandeep Kumar Chandel

Master's thesis

Anotácia:

Intrusion detection system is a necessity of today's information security domain. It plays a vital role in detection of anomalous traffic in a network and alerts the network administrators to manage such traffic. The work presented in this thesis is an attempt to detect such traffic anomalies in the networks by generating and analyzing the traffic flow data. This IDS presented in this thesis implements the k-means approach of data mining for intrusion detection and the outlier detection approach using neighborhood outlier factor to detect the anomalies present in the traffic flow. The k-means approach uses clustering mechanisms to group the traffic flow data into normal and anomalous clusters. Outlier detection calculates an outlier score for each flow record. This score is called the neighborhood outlier factor (NOF), whose value decides whether a particular traffic flow is normal or anomalous. The performance of these two approaches is compared by means of various confusion matrix and performance metrics like false positive rate, sensitivity, specificity, classification rate and precision and an analysis is done to find out that which one of the two approaches is better to be used for intrusion detection using traffic flows.

Abstract:

Intrusion detection system is a necessity of today's information security domain. It plays a vital role in detection of anomalous traffic in a network and alerts the network administrators to manage such traffic. The work presented in this thesis is an attempt to detect such traffic anomalies in the networks by generating and analyzing the traffic flow data. This IDS presented in this thesis implements the k-means approach of data mining for intrusion detection and the outlier detection approach using neighborhood outlier factor to detect the anomalies present in the traffic flow. The k-means approach uses clustering mechanisms to group the traffic flow data into normal and anomalous clusters. Outlier detection calculates an outlier score for each flow record. This score is called the neighborhood outlier factor (NOF), whose value decides whether a particular traffic flow is normal or anomalous. The performance of these two approaches is compared by means of various confusion matrix and performance metrics like false positive rate, sensitivity, specificity, classification rate and precision and an analysis is done to find out that which one of the two approaches is better to be used for intrusion detection using traffic flows.

Keywords

bytes, classification rate, false negative rate, false positive rate, outliers, packets, precision, sensitivity, specificity, traffic flow

Jazyk práce: English

Datum vytvoření / odevzdání či podání práce: 22. 5. 2017

Obhajoba závěrečné práce

• Obhajoba proběhla 20. 6. 2017
• Vedúci: prof. RNDr. Václav Matyáš, M.Sc.
• Oponent: RNDr. Marek Kumpošt, Ph.D.

Masaryk University

Faculty of Informatics

Master programme / odbor:
Informatics / Information Technology Security (eng.)