Network intrusion detection based on LDA for payload feature selection

Zhiyuan Tan, Aruna Jamdagni, Xiangjian He, Priyadarsi Nanda

Research output: Chapter in Book/Conference proceedingConference contributionpeer-review

18 Citations (Scopus)

Abstract

Anomaly Intrusion Detection System (IDS) is a statistical based network IDS which can detect attack variants and novel attacks without a priori knowledge. Current anomaly IDSs are inefficient for real-time detection because of their complex computation. This paper proposes a novel approach to reduce the heavy computational cost of an anomaly IDS. Linear Discriminant Analysis (LDA) and difference distance map are used for selection of significant features. This approach is able to transform high-dimensional feature vectors into a low-dimensional domain. The similarity between new incoming packets and a normal profile is determined using Euclidean distance on the simple, low-dimensional feature domain. The final decision will be made according to a pre-calculated threshold to differentiate normal and abnormal network packets. The proposed approach is evaluated using DARPA 1999 IDS dataset.

Original languageEnglish
Title of host publication2010 IEEE Globecom Workshops, GC'10
Pages1545-1549
Number of pages5
DOIs
Publication statusPublished - 2010
Externally publishedYes
Event2010 IEEE Globecom Workshops, GC'10 - Miami, FL, United States
Duration: 5 Dec 201010 Dec 2010

Publication series

Name2010 IEEE Globecom Workshops, GC'10

Conference

Conference2010 IEEE Globecom Workshops, GC'10
Country/TerritoryUnited States
CityMiami, FL
Period5/12/1010/12/10

Keywords

  • Euclidean distance
  • Feature selection
  • Linear discriminant analysis
  • Network intrusion detection
  • Packet payload

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Communication

Fingerprint

Dive into the research topics of 'Network intrusion detection based on LDA for payload feature selection'. Together they form a unique fingerprint.

Cite this