Detecting Network Intrusion through Anomalous Packet Identification

Abstract

Rule based intrusion detection depends on the attack signature database which has to be constantly updated, requiring time and efforts. Anomaly based intrusion detection through unsupervised methods does not require comparing with attack signatures. However, detecting anomalous behaviour is a complex task. In this paper, we have proposed an unsupervised approach for anomalous network traffic identification by combining dimensionality reduction with sub-space clustering. Our approach takes the attribute values from network traffics as input, performs principal component analysis on them, and then applies density-based clustering on each possible three dimensional sub-spaces to rank the outliers. Results show that our proposed approach detects a wide range of anomalous network session which included instances of intrusive sessions too. The evaluation of this approach showed significant accuracy and faster detection with a zero false negative rate, implying that no instance of the listed attacks went undetected.