Abstract
We previously developed a clustering and classification algorithm—supervised (CCAS) to learn patterns of normal and intrusive activities and to classify observed system activities. Here we further enhance the robustness of CCAS to the presentation order of training data and the noises in training data. This robust CCAS adds data redistribution, a supervised hierarchical grouping of clusters and removal of outliers as the postprocessing steps.
References
Axelsson S (2000) Intrusion detection systems: a survey and taxonomy. Report, Dept of Computer Engineering, Chalmers University of Technology, Goteborg, Sweden
Ester M, Kriegel HP, Sander J, Wimmer M, Xu X (1998) Incremental clustering for mining in a data warehousing environment. Proc 24th VLDB conference, New York, USA
Harsha SG, Choudhary A (1999) Parallel subspace clustering for very large data sets. Technical report CPDC-TR-9906-010, Northwestern University, Evanston, Illinois, USA
Huang C, Bi Q, Stiles R, Harris R (1992) Fast full search equivalent encoding algorithms for image compression using vector quantization. IEEE Trans Image Process 1(3):413–416
Jain AK, Dubes RC (1988) Algorithms for clustering data. Prentice Hall
Li X, Ye N (2002) Grid- and dummy-cluster-based learning of normal and intrusive clusters for computer intrusion detection. Qual Reliabil Eng Int 18(3)
Lim TS, Loh WY, Shih YS (2000) A comparison of prediction accuracy, complexity, and training time of thirty-three old and new classification algorithms. Mach Learn J 40:203–228
Zhang T (1997) Data clustering for very large datasets plus applications. Ph.D. Thesis, Department of Computer Science, University of Wisconsin–Madison, Madison, Wisconsin, USA
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Li, X., Ye, N. A supervised clustering algorithm for computer intrusion detection. Knowl Inf Syst 8, 498–509 (2005). https://doi.org/10.1007/s10115-005-0195-8
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10115-005-0195-8