Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors Export

@inproceedings{frias-martinez:clustering, abstract = {Anomaly detection (AD) sensors compute behavior profiles to recognize malicious or anomalous activities. The behavior of a host is checked continuously by the AD sensor and an alert is raised when the behavior deviates from its behavior profile. Unfortunately, the majority of AD sensors suffer from high volumes of false alerts either maliciously crafted by the host or originating from insufficient training of the sensor. We present a cluster-based AD sensor that relies on clusters of behavior profiles to identify anomalous behavior. The behavior of a host raises an alert only when a group of host profiles with similar behavior (cluster of behavior profiles) detect the anomaly, rather than just relying on the host's own behavior profile to raise the alert (single-profile AD sensor). A cluster-based AD sensor significantly decreases the volume of false alerts by providing a more robust model of normal behavior based on clusters of behavior profiles. Additionally, we introduce an architecture designed for the deployment of cluster-based AD sensors. The behavior profile of each network host is computed by its closest switch that is also responsible for performing the anomaly detection for each of the hosts in its subnet. By placing the AD sensors at the switch, we eliminate the possibility of hosts crafting malicious alerts. Our experimental results based on wireless behavior profiles from users in the CRAWDAD dataset show that the volume of false alerts generated by cluster-based AD sensors is reduced by at least 50\% compared to single-profile AD sensors.}, author = {Martinez, V. Frias and Stolfo, S. J. and Keromytis, A. D.}, booktitle = {Computer Security Applications Conference, 2008. ACSAC 2008. Annual}, citeulike-article-id = {5319312}, citeulike-linkout-0 = {http://dx.doi.org/10.1109/ACSAC.2008.30}, citeulike-linkout-1 = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4721573}, citeulike-linkout-2 = {http://sneakers.cs.columbia.edu/ids/publications/acsac2008.pdf}, doi = {10.1109/ACSAC.2008.30}, journal = {Computer Security Applications Conference, 2008. ACSAC 2008. Annual}, keywords = {anomaly-detection, clustering, crawdad, dartmouth\_campus, intrusion-detection}, pages = {367--376}, posted-at = {2009-08-01 10:44:49}, priority = {2}, title = {Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors}, url = {http://dx.doi.org/10.1109/ACSAC.2008.30}, year = {2008} }

TY - CONF ID - frias-martinez:clustering L3 - citeulike-article-id:5319312 N2 - Anomaly detection (AD) sensors compute behavior profiles to recognize malicious or anomalous activities. The behavior of a host is checked continuously by the AD sensor and an alert is raised when the behavior deviates from its behavior profile. Unfortunately, the majority of AD sensors suffer from high volumes of false alerts either maliciously crafted by the host or originating from insufficient training of the sensor. We present a cluster-based AD sensor that relies on clusters of behavior profiles to identify anomalous behavior. The behavior of a host raises an alert only when a group of host profiles with similar behavior (cluster of behavior profiles) detect the anomaly, rather than just relying on the host's own behavior profile to raise the alert (single-profile AD sensor). A cluster-based AD sensor significantly decreases the volume of false alerts by providing a more robust model of normal behavior based on clusters of behavior profiles. Additionally, we introduce an architecture designed for the deployment of cluster-based AD sensors. The behavior profile of each network host is computed by its closest switch that is also responsible for performing the anomaly detection for each of the hosts in its subnet. By placing the AD sensors at the switch, we eliminate the possibility of hosts crafting malicious alerts. Our experimental results based on wireless behavior profiles from users in the CRAWDAD dataset show that the volume of false alerts generated by cluster-based AD sensors is reduced by at least 50% compared to single-profile AD sensors. JF - Computer Security Applications Conference, 2008. ACSAC 2008. Annual EP - 376 TI - Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors T2 - Computer Security Applications Conference, 2008. ACSAC 2008. Annual SP - 367 KW - anomaly-detection KW - clustering KW - crawdad KW - dartmouth_campus KW - intrusion-detection AU - Martinez, Frias AU - Stolfo, SJ AU - Keromytis, AD PY - 2008/// UR - http://dx.doi.org/10.1109/ACSAC.2008.30 ER -