Authors:
Denis Hock
1
;
Martin Kappes
1
and
Bogdan Ghita
2
Affiliations:
1
Frankfurt University of Applied Sciences, Germany
;
2
Plymouth University, United Kingdom
Keyword(s):
Computer Networks, Network Anomaly Detection, Clustering.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Intrusion Detection & Prevention
;
Network Security
;
Wireless Network Security
Abstract:
While Anomaly Detection is commonly accepted as an appropriate technique to uncover yet unknown network
misuse patterns and malware, detection rates are often diminished by, e.g., unpredictable user behavior,
new applications and concept changes. In this paper, we propose and evaluate the benefits of using clustering
methods for data preprocessing in Anomaly Detection in order to improve detection rates even in the presence
of such events. We study our pre-clustering approach for different features such as IP addresses, traffic characteristics
and application layer protocols. Our results obtained by analyzing detection rates for real network
traffic with actual intrusions indicates that our approach does indeed significantly improve detection rates and,
moreover, is practically feasible.