Intrusion detection clustering using OPTICS - Del Mundo, Joseph Benjamin T.; Festin, Susan P. (Quezon City College of Engineering, University of the Philippines Diliman, 2015)
New types and variations of computer intrusions develop everyday and intrusion detection systems (IDS) face the challenge of having not enough information about them. We believe that we can still detect new intrusions by using the existing information about the currently known intrusions and the normal system behaviors. In this thesis, we propose to use clustering, a data mining technique to group incoming network packets with the system's knowledge base. The knowledge base contains packets from the authorized connections as well as packets from known intrusions. We choose OPTICS clustering to group the packets together. We decide whether the incoming packet is an intrusion or not based on the cluster it falls into. We also aim to increase detection rates of the current known intrusions. We also compare detection rates if information about the known intrusions are presented to IDS. This can help identify new and novel intrusions that are not present in the system. We determine whether these information about the intrusions are significant or not. Upon observation of the results, the OPTICS algorithm have correctly ordered the packets together. The detection rates and false positive rates depends on the amount of prior attack information in the knowledge base. Inclusion of intrusion packets with the same type gives the highest detection rate.
Thesis (M.S. Computer Science)--University of the Philippines Diliman
Keywords: Intrusion detection systems (Computer security)