%0 Conference Proceedings
%T UNADA: Unsupervised Network Anomaly Detection Using Sub-space Outliers Ranking
%+ Laboratoire d'analyse et d'architecture des systèmes (LAAS)
%+ PRES Université de Toulouse
%A Casas, Pedro
%A Mazel, Johan
%A Owezarski, Philippe
%Z Part 1: Anomaly Detection
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 10th IFIP Networking Conference (NETWORKING)
%C Valencia, Spain
%Y Jordi Domingo-Pascual
%Y Pietro Manzoni
%Y Sergio Palazzo
%Y Ana Pont
%Y Caterina Scoglio
%I Springer
%3 NETWORKING 2011
%V LNCS-6640
%N Part I
%P 40-51
%8 2011-05-09
%D 2011
%R 10.1007/978-3-642-20757-0_4
%K Unsupervised Anomaly Detection
%K Sub-Space Clustering
%K Evidence Accumulation
%K Outliers Detection
%K Abnormality Ranking
%Z Computer Science [cs]
%Z Computer Science [cs]/Networking and Internet Architecture [cs.NI]Conference papers
%X Current network monitoring systems rely strongly on signa-ture-based and supervised-learning-based detection methods to hunt out network attacks and anomalies. Despite being opposite in nature, both approaches share a common downside: they require the knowledge provided by an expert system, either in terms of anomaly signatures, or as normal-operation profiles. In a diametrically opposite perspective we introduce UNADA, an Unsupervised Network Anomaly Detection Algorithm for knowledge-independent detection of anomalous traffic. UNADA uses a novel clustering technique based on Sub-Space-Density clustering to identify clusters and outliers in multiple low-dimensional spaces. The evidence of traffic structure provided by these multiple clusterings is then combined to produce an abnormality ranking of traffic flows, using a correlation-distance-based approach. We evaluate the ability of UNADA to discover network attacks in real traffic without relying on signatures, learning, or labeled traffic. Additionally, we compare its performance against previous unsupervised detection methods using traffic from two different networks.
%G English
%Z TC 6
%2 https://inria.hal.science/hal-01583411/document
%2 https://inria.hal.science/hal-01583411/file/978-3-642-20757-0_4_Chapter.pdf
%L hal-01583411
%U https://inria.hal.science/hal-01583411
%~ UNIV-TLSE2
%~ UNIV-TLSE3
%~ CNRS
%~ INSA-TOULOUSE
%~ LAAS
%~ UT1-CAPITOLE
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-TC6
%~ IFIP-NETWORKING
%~ IFIP-LNCS-6640
%~ INSA-GROUPE
%~ TOULOUSE-INP
%~ UNIV-UT3
%~ UT3-INP
%~ UT3-TOULOUSEINP
%~ TEST7-HALCNRS