Publication: Labelling IDS clusters by means of the silhouette index
Loading...
Identifiers
Publication date
2006-09
Defense date
Advisors
Tutors
Journal Title
Journal ISSN
Volume Title
Publisher
Jordi Herrera Joancomarti
Joan Borrell Viader
Joan Borrell Viader
Impact
Export
Abstract
One of the most difficult problems in the design of an anomaly based intrusion detection system (IDS) that uses clustering is that of labelling the ob- tained clusters, i.e. determining which of them correspond to ”good” behaviour on the network/host and which to ”bad” behaviour. In this paper, a new clusters’ labelling strategy, which makes use of the Silhouette clustering quality index is proposed for application in such an IDS. The aim of the new labelling algorithm is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. The effectiveness of a multiple classifier IDS with the Silhouette index implemented is compared to the effectiveness of a system em- ploying a classical cardinality-based labelling strategy. Experimental results show that the system using the Silhouette index produces much more accurate results than the system that uses the classical cardinality-based labelling. Possibilities of improving the overall efficiency of an IDS using the new labelling algorithm are also discussed.
Description
Proceeding of: IX Reunión Española sobre Criptología y Seguridad de la Información. Barcelona, 2006
Keywords
Anomaly detection, Clustering, Intrusion detection system, Silhoutte
Bibliographic citation
Actas de la IX Reunión Española sobre Criptología y Seguridad de la Información. Barcelona : Jordi Herrera y Joan Borrell, 2006, pp. 760-772