Show simple item record

dc.contributor.authorWang, Wei
dc.contributor.authorZhang, Xiangliang
dc.contributor.authorPitsilis, Georgios
dc.date.accessioned2015-08-04T06:21:18Z
dc.date.available2015-08-04T06:21:18Z
dc.date.issued2010
dc.identifier.citationWang, W., Zhang, X., & Pitsilis, G. (2010). Abstracting Audit Data for Lightweight Intrusion Detection. Lecture Notes in Computer Science, 201–215. doi:10.1007/978-3-642-17714-9_15
dc.identifier.isbn3642177131; 9783642177132
dc.identifier.issn03029743
dc.identifier.doi10.1007/978-3-642-17714-9_15
dc.identifier.urihttp://hdl.handle.net/10754/564265
dc.description.abstractHigh speed of processing massive audit data is crucial for an anomaly Intrusion Detection System (IDS) to achieve real-time performance during the detection. Abstracting audit data is a potential solution to improve the efficiency of data processing. In this work, we propose two strategies of data abstraction in order to build a lightweight detection model. The first strategy is exemplar extraction and the second is attribute abstraction. Two clustering algorithms, Affinity Propagation (AP) as well as traditional k-means, are employed to extract the exemplars, and Principal Component Analysis (PCA) is employed to abstract important attributes (a.k.a. features) from the audit data. Real HTTP traffic data collected in our institute as well as KDD 1999 data are used to validate the two strategies of data abstraction. The extensive test results show that the process of exemplar extraction significantly improves the detection efficiency and has a better detection performance than PCA in data abstraction. © 2010 Springer-Verlag.
dc.publisherSpringer Nature
dc.titleAbstracting audit data for lightweight intrusion detection
dc.typeConference Paper
dc.contributor.departmentComputer, Electrical and Mathematical Sciences and Engineering (CEMSE) Division
dc.contributor.departmentComputer Science Program
dc.contributor.departmentMachine Intelligence & kNowledge Engineering Lab
dc.identifier.journalLecture Notes in Computer Science
dc.conference.date17 December 2010 through 19 December 2010
dc.conference.name6th International Conference on Information Systems Security, ICISS 2010
dc.conference.locationGandhinagar
dc.contributor.institutionInterdisciplinary Centre for Security, Reliability and Trust (SnT Centre), Université du Luxembourg, Luxembourg, Luxembourg
dc.contributor.institutionFaculty of Science, Technology and Communication, Université du Luxembourg, Luxembourg, Luxembourg
kaust.personZhang, Xiangliang


This item appears in the following Collection(s)

Show simple item record