Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection

Harald Lampesberger

doi:10.1109/EC2ND.2010.10

Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection

Research output: Chapter in Book/Report/Conference proceedings › Conference contribution

Abstract

Anomaly detection in computer networks is an actively researched topic in the field of intrusion detection. The Internet Analysis System (IAS) is a software framework which provides passive probes and centralized backend services to collect purely statistical network data in distributed computer networks. This paper presents an empirical evaluation of the IAS data format for detecting anomalies, caused by attack traffic. This process involved the generation of labeled evaluation data based on the 1999 DARPA Intrusion Detection Evaluation data sets and two different supervised machine learning approaches for the assessment. The results of this evaluation conclude, that the IAS is not a convenient data source for advanced anomaly detection in the scope of our research.

Original language	English
Title of host publication	Proceedings - European Conference on Computer Network Defense, EC2ND 2010
Publisher	IEEE Computer Society Press
Pages	63-70
Number of pages	8
ISBN (Print)	9780769543116
DOIs	https://doi.org/10.1109/EC2ND.2010.10
Publication status	Published - 2010
Event	EC2ND 2010 - Berlin, Germany Duration: 28 Oct 2010 → 29 Oct 2010 http://2010.ec2nd.org

Publication series

Name	Proceedings - European Conference on Computer Network Defense, EC2ND 2010

Conference

Conference	EC2ND 2010
Country/Territory	Germany
City	Berlin
Period	28.10.2010 → 29.10.2010
Internet address	http://2010.ec2nd.org

Keywords

evaluation data
intrusion detection
machine learning
supervised anomaly detection
Supervised anomaly detection
Intrusion detection
Machine learning
Evaluation data

Access to Document

10.1109/EC2ND.2010.10

Cite this

Lampesberger, H. (2010). Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection. In Proceedings - European Conference on Computer Network Defense, EC2ND 2010 (pp. 63-70). Article 5663318 (Proceedings - European Conference on Computer Network Defense, EC2ND 2010). IEEE Computer Society Press. https://doi.org/10.1109/EC2ND.2010.10

@inproceedings{e344079126b649dca52ed801a88ac383,

title = "Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection",

abstract = "Anomaly detection in computer networks is an actively researched topic in the field of intrusion detection. The Internet Analysis System (IAS) is a software framework which provides passive probes and centralized backend services to collect purely statistical network data in distributed computer networks. This paper presents an empirical evaluation of the IAS data format for detecting anomalies, caused by attack traffic. This process involved the generation of labeled evaluation data based on the 1999 DARPA Intrusion Detection Evaluation data sets and two different supervised machine learning approaches for the assessment. The results of this evaluation conclude, that the IAS is not a convenient data source for advanced anomaly detection in the scope of our research.",

keywords = "evaluation data, intrusion detection, machine learning, supervised anomaly detection, evaluation data, intrusion detection, machine learning, supervised anomaly detection, Supervised anomaly detection, Intrusion detection, Machine learning, Evaluation data",

author = "Harald Lampesberger",

year = "2010",

doi = "10.1109/EC2ND.2010.10",

language = "English",

isbn = "9780769543116",

series = "Proceedings - European Conference on Computer Network Defense, EC2ND 2010",

publisher = "IEEE Computer Society Press",

pages = "63--70",

booktitle = "Proceedings - European Conference on Computer Network Defense, EC2ND 2010",

note = "EC2ND 2010 ; Conference date: 28-10-2010 Through 29-10-2010",

url = "http://2010.ec2nd.org",

}

Lampesberger, H 2010, Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection. in Proceedings - European Conference on Computer Network Defense, EC2ND 2010., 5663318, Proceedings - European Conference on Computer Network Defense, EC2ND 2010, IEEE Computer Society Press, pp. 63-70, EC2ND 2010, Berlin, Germany, 28.10.2010. https://doi.org/10.1109/EC2ND.2010.10

Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection. / Lampesberger, Harald.
Proceedings - European Conference on Computer Network Defense, EC2ND 2010. IEEE Computer Society Press, 2010. p. 63-70 5663318 (Proceedings - European Conference on Computer Network Defense, EC2ND 2010).

Research output: Chapter in Book/Report/Conference proceedings › Conference contribution

TY - GEN

T1 - Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection

AU - Lampesberger, Harald

PY - 2010

Y1 - 2010

N2 - Anomaly detection in computer networks is an actively researched topic in the field of intrusion detection. The Internet Analysis System (IAS) is a software framework which provides passive probes and centralized backend services to collect purely statistical network data in distributed computer networks. This paper presents an empirical evaluation of the IAS data format for detecting anomalies, caused by attack traffic. This process involved the generation of labeled evaluation data based on the 1999 DARPA Intrusion Detection Evaluation data sets and two different supervised machine learning approaches for the assessment. The results of this evaluation conclude, that the IAS is not a convenient data source for advanced anomaly detection in the scope of our research.

AB - Anomaly detection in computer networks is an actively researched topic in the field of intrusion detection. The Internet Analysis System (IAS) is a software framework which provides passive probes and centralized backend services to collect purely statistical network data in distributed computer networks. This paper presents an empirical evaluation of the IAS data format for detecting anomalies, caused by attack traffic. This process involved the generation of labeled evaluation data based on the 1999 DARPA Intrusion Detection Evaluation data sets and two different supervised machine learning approaches for the assessment. The results of this evaluation conclude, that the IAS is not a convenient data source for advanced anomaly detection in the scope of our research.

KW - evaluation data

KW - intrusion detection

KW - machine learning

KW - supervised anomaly detection

KW - evaluation data

KW - intrusion detection

KW - machine learning

KW - supervised anomaly detection

KW - Supervised anomaly detection

KW - Intrusion detection

KW - Machine learning

KW - Evaluation data

UR - http://www.scopus.com/inward/record.url?scp=78650920488&partnerID=8YFLogxK

U2 - 10.1109/EC2ND.2010.10

DO - 10.1109/EC2ND.2010.10

M3 - Conference contribution

SN - 9780769543116

T3 - Proceedings - European Conference on Computer Network Defense, EC2ND 2010

SP - 63

EP - 70

BT - Proceedings - European Conference on Computer Network Defense, EC2ND 2010

PB - IEEE Computer Society Press

T2 - EC2ND 2010

Y2 - 28 October 2010 through 29 October 2010

ER -

Empirical Evaluation of the Internet Analysis System for Application in the Field of Anomaly Detection

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this