Usage behavior profiling for anomaly detection using vector quantization

Jun Zheng; Mingzeng Hu; Hongli Zhang

Usage behavior profiling for anomaly detection using vector quantization

Jun Zheng^*
, Mingzeng Hu
, Hongli Zhang

^*Corresponding author for this work

School of Computer Science and Technology, Harbin Institute of Technology

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Scopus citations

Abstract

In network security community, anomaly detection is the research center as one of the important intrusion detection approaches. Constructing the usage behavior profile is the first important step in anomaly detection. In this paper, using the self-organizing maps (SOM), we propose to design the vector quantization (VQ) framework to build usage profile for anomaly detection. After the feature attribute extraction, the network traffic flow is translated into the feature vector style. And then, the network traffic usage behavior profile can be represented by the VQ codebook from which the behaviour deviation can be measured quantitatively. Via the intrusion detection benchmark data of "DARPA Intrusion Detection Evaluation" in experiments, it is shown that the network attacks are detected with high detection rates and low false alarms.

Original language	English
Title of host publication	Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005
Editors	A.O. Fapojuwo
Pages	107-112
Number of pages	6
State	Published - 2005
Externally published	Yes
Event	IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED International Multi-Conference on Wireless and Optical Communications, CSA 2005 - Banff, AB, Canada Duration: 19 Jul 2005 → 21 Jul 2005

Publication series

Name	Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005

Conference

Conference	IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED International Multi-Conference on Wireless and Optical Communications, CSA 2005
Country/Territory	Canada
City	Banff, AB
Period	19/07/05 → 21/07/05

Keywords

Anomaly detection
Codebook
Self-organizing map
Usage behavior profile
Vector quantization

Cite this

Zheng, J., Hu, M., & Zhang, H. (2005). Usage behavior profiling for anomaly detection using vector quantization. In A. O. Fapojuwo (Ed.), Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005 (pp. 107-112). (Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005).

Zheng, Jun ; Hu, Mingzeng ; Zhang, Hongli. / Usage behavior profiling for anomaly detection using vector quantization. Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005. editor / A.O. Fapojuwo. 2005. pp. 107-112 (Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005).

@inproceedings{2dc258c5eaae4c15bd7a2a5bb034576f,

title = "Usage behavior profiling for anomaly detection using vector quantization",

abstract = "In network security community, anomaly detection is the research center as one of the important intrusion detection approaches. Constructing the usage behavior profile is the first important step in anomaly detection. In this paper, using the self-organizing maps (SOM), we propose to design the vector quantization (VQ) framework to build usage profile for anomaly detection. After the feature attribute extraction, the network traffic flow is translated into the feature vector style. And then, the network traffic usage behavior profile can be represented by the VQ codebook from which the behaviour deviation can be measured quantitatively. Via the intrusion detection benchmark data of {"}DARPA Intrusion Detection Evaluation{"} in experiments, it is shown that the network attacks are detected with high detection rates and low false alarms.",

keywords = "Anomaly detection, Codebook, Self-organizing map, Usage behavior profile, Vector quantization",

author = "Jun Zheng and Mingzeng Hu and Hongli Zhang",

year = "2005",

language = "英语",

isbn = "0889864934",

series = "Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005",

pages = "107--112",

editor = "A.O. Fapojuwo",

booktitle = "Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005",

note = "IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED International Multi-Conference on Wireless and Optical Communications, CSA 2005 ; Conference date: 19-07-2005 Through 21-07-2005",

}

Zheng, J, Hu, M & Zhang, H 2005, Usage behavior profiling for anomaly detection using vector quantization. in AO Fapojuwo (ed.), Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005. Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005, pp. 107-112, IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED International Multi-Conference on Wireless and Optical Communications, CSA 2005, Banff, AB, Canada, 19/07/05.

Usage behavior profiling for anomaly detection using vector quantization. / Zheng, Jun; Hu, Mingzeng; Zhang, Hongli.
Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005. ed. / A.O. Fapojuwo. 2005. p. 107-112 (Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Usage behavior profiling for anomaly detection using vector quantization

AU - Zheng, Jun

AU - Hu, Mingzeng

AU - Zhang, Hongli

PY - 2005

Y1 - 2005

N2 - In network security community, anomaly detection is the research center as one of the important intrusion detection approaches. Constructing the usage behavior profile is the first important step in anomaly detection. In this paper, using the self-organizing maps (SOM), we propose to design the vector quantization (VQ) framework to build usage profile for anomaly detection. After the feature attribute extraction, the network traffic flow is translated into the feature vector style. And then, the network traffic usage behavior profile can be represented by the VQ codebook from which the behaviour deviation can be measured quantitatively. Via the intrusion detection benchmark data of "DARPA Intrusion Detection Evaluation" in experiments, it is shown that the network attacks are detected with high detection rates and low false alarms.

AB - In network security community, anomaly detection is the research center as one of the important intrusion detection approaches. Constructing the usage behavior profile is the first important step in anomaly detection. In this paper, using the self-organizing maps (SOM), we propose to design the vector quantization (VQ) framework to build usage profile for anomaly detection. After the feature attribute extraction, the network traffic flow is translated into the feature vector style. And then, the network traffic usage behavior profile can be represented by the VQ codebook from which the behaviour deviation can be measured quantitatively. Via the intrusion detection benchmark data of "DARPA Intrusion Detection Evaluation" in experiments, it is shown that the network attacks are detected with high detection rates and low false alarms.

KW - Anomaly detection

KW - Codebook

KW - Self-organizing map

KW - Usage behavior profile

KW - Vector quantization

UR - https://www.scopus.com/pages/publications/33644552431

M3 - 会议稿件

AN - SCOPUS:33644552431

SN - 0889864934

T3 - Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005

SP - 107

EP - 112

BT - Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005

A2 - Fapojuwo, A.O.

T2 - IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED International Multi-Conference on Wireless and Optical Communications, CSA 2005

Y2 - 19 July 2005 through 21 July 2005

ER -

Zheng J, Hu M, Zhang H. Usage behavior profiling for anomaly detection using vector quantization. In Fapojuwo AO, editor, Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005. 2005. p. 107-112. (Proceedings of the IASTED International Conference on Communication Systems and Applications, as part of the Fifth IASTED Int. Multi-Conference on Wireless and Optical Communications, CSA 2005).

Usage behavior profiling for anomaly detection using vector quantization

Abstract

Publication series

Conference

Keywords

Other files and links

Fingerprint

Cite this