3 research outputs found
Combining conjunctive rule extraction with diffusion maps for network intrusion detection
Network security and intrusion detection are important
in the modern world where communication happens
via information networks. Traditional signature-based intrusion
detection methods cannot find previously unknown attacks. On
the other hand, algorithms used for anomaly detection often
have black box qualities that are difficult to understand for
people who are not algorithm experts. Rule extraction methods
create interpretable rule sets that act as classifiers. They have
mostly been combined with already labeled data sets. This
paper aims to combine unsupervised anomaly detection with
rule extraction techniques to create an online anomaly detection
framework. Unsupervised anomaly detection uses diffusion maps
and clustering for labeling an unknown data set. Rule sets are
created using conjunctive rule extraction algorithm. This research
suggests that the combination of machine learning methods and
rule extraction is a feasible way to implement network intrusion
detection that is meaningful to network administrators.peerReviewe
Sipola T. Combining conjunctive rule extraction with diffusion maps for network intrusion detection
Abstract-Network security and intrusion detection are important in the modern world where communication happens via information networks. Traditional signature-based intrusion detection methods cannot find previously unknown attacks. On the other hand, algorithms used for anomaly detection often have black box qualities that are difficult to understand for people who are not algorithm experts. Rule extraction methods create interpretable rule sets that act as classifiers. They have mostly been combined with already labeled data sets. This paper aims to combine unsupervised anomaly detection with rule extraction techniques to create an online anomaly detection framework. Unsupervised anomaly detection uses diffusion maps and clustering for labeling an unknown data set. Rule sets are created using conjunctive rule extraction algorithm. This research suggests that the combination of machine learning methods and rule extraction is a feasible way to implement network intrusion detection that is meaningful to network administrators