Mining Common Outliers for Intrusion Detection

Data mining for intrusion detection can be divided into several sub-topics, among which unsupervised clustering (which has controversial properties). Unsupervised clustering for intrusion detection aims to i) group behaviours together depending on their similarity and ii) detect groups containing only one (or very few) behaviour(s). Such isolated behaviours seem to deviate from the model of normality; therefore, they are considered as malicious. Obviously, not all atypical behaviours are attacks or intrusion attempts. This represents one drawback of intrusion detection methods based on clustering. We take into account the addition of a new feature to isolated behaviours before they are considered malicious. This feature is based on the possible repeated occurrences of the bahaviour on many information systems. Based on this feature, we propose a new outlier mining method which we validate through a set of experiments. Goverdhan Singh INRIA, 2004 route des lucioles BP 93, FR-06902 Sophia Antipolis e-mail: [email protected] Florent Masseglia INRIA, 2004 route des lucioles BP 93, FR-06902 Sophia Antipolis e-mail: [email protected] Céline Fiot INRIA, 2004 route des lucioles BP 93, FR-06902 Sophia Antipolis e-mail: [email protected] Alice Marascu INRIA, 2004 route des lucioles BP 93, FR-06902 Sophia Antipolis e-mail: [email protected] Pascal Poncelet LIRMM UMR CNRS 5506, 161 Rue Ada, 34392 Montpellier Cedex 5, France e-mail: [email protected]