Building multiple behavioral models for network intrusion identification

Wei Wang (1) , Sylvain Gombault (1) , Amine Bsila (1)

1 RSM - Département Réseaux, Sécurité et Multimédia

In stead of only profiling normal behavior for network anomaly intrusion, in this paper, we not only build normal behavioral models, but also establish individual attack behavioral models for network intrusion identification. Normal behavioral model is built based on normal data and individual attack behavioral models are built based on individual attack data. K-Nearest Neighbor (kNN) and Principal Component Analysis (PCA) are used for identifying network intrusions based on the multiple behavioral models. The methods and the models are tested with KDD 99 data sets and testing results show that the two methods are promising in terms of identification accuracy. Some merits as well as limitations of the two methods for intrusion identification are also discussed and analyzed.

Mots clés: Intrusion identification; Network packet; Network anomaly detection

Domaines: Multimédia [cs.MM]; Réseaux et télécommunications [cs.NI]

Wei Wang, Sylvain Gombault, Amine Bsila. Building multiple behavioral models for network intrusion identification. MonAM'2007: 2nd IEEE Workshop on Monitoring, Attack Detection and Mitigation, Nov 2007, Toulouse, France. pp.31 - 36. ⟨hal-02057795⟩