<?xml version="1.0" encoding="UTF-8"?>
<collection xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.loc.gov/MARC21/slim http://www.loc.gov/standards/marcxml/schema/MARC21slim.xsd" xmlns="http://www.loc.gov/MARC21/slim">
 <record>
  <leader>00000ctm a22000004i 4500</leader>
  <controlfield tag="001">UP-99796217611761518</controlfield>
  <controlfield tag="003">Buklod</controlfield>
  <controlfield tag="005">20230215105418.0</controlfield>
  <controlfield tag="006">m    |o  d |      </controlfield>
  <controlfield tag="007">ta</controlfield>
  <controlfield tag="008">150910s        xx     d     r    |||| u|</controlfield>
  <datafield tag="035" ind1=" " ind2=" ">
   <subfield code="a">(iLib)UPD-00249806020</subfield>
  </datafield>
  <datafield tag="040" ind1=" " ind2=" ">
   <subfield code="a">DENG</subfield>
   <subfield code="e">rda</subfield>
  </datafield>
  <datafield tag="041" ind1="0" ind2=" ">
   <subfield code="a">eng</subfield>
  </datafield>
  <datafield tag="042" ind1=" " ind2=" ">
   <subfield code="a">DMLUC</subfield>
  </datafield>
  <datafield tag="090" ind1=" " ind2=" ">
   <subfield code="a">LG 995 2015 C65</subfield>
   <subfield code="b">D45</subfield>
  </datafield>
  <datafield tag="100" ind1="1" ind2=" ">
   <subfield code="a">Del Mundo, Joseph Benjamin T.</subfield>
   <subfield code="e">author.</subfield>
  </datafield>
  <datafield tag="245" ind1="1" ind2="0">
   <subfield code="a">Intrusion detection clustering using OPTICS</subfield>
   <subfield code="c">thesis by Joseph Benjamin Del Mundo ; Susan Pancho-Festin, adviser.</subfield>
  </datafield>
  <datafield tag="264" ind1=" " ind2="0">
   <subfield code="a">Quezon City</subfield>
   <subfield code="b">College of Engineering, University of the Philippines Diliman</subfield>
   <subfield code="c">2015.</subfield>
  </datafield>
  <datafield tag="300" ind1=" " ind2=" ">
   <subfield code="a">v, 56 leaves</subfield>
   <subfield code="b">color illustrations</subfield>
  </datafield>
  <datafield tag="336" ind1=" " ind2=" ">
   <subfield code="a">text</subfield>
   <subfield code="2">rdacontent</subfield>
  </datafield>
  <datafield tag="337" ind1=" " ind2=" ">
   <subfield code="a">unmediated</subfield>
   <subfield code="2">rdamedia</subfield>
  </datafield>
  <datafield tag="338" ind1=" " ind2=" ">
   <subfield code="a">volume</subfield>
   <subfield code="2">rdacarrier</subfield>
  </datafield>
  <datafield tag="502" ind1=" " ind2=" ">
   <subfield code="a">Thesis (M.S. Computer Science)--University of the Philippines Diliman</subfield>
   <subfield code="d">June 2015.</subfield>
  </datafield>
  <datafield tag="506" ind1=" " ind2=" ">
   <subfield code="a">Available to the general public.</subfield>
  </datafield>
  <datafield tag="520" ind1="3" ind2=" ">
   <subfield code="a">New types and variations of computer intrusions develop everyday and intrusion detection systems (IDS) face the challenge of having not enough information about them. We believe that we can still detect new intrusions by using the existing information about the currently known intrusions and the normal system behaviors. In this thesis, we propose to use clustering, a data mining technique to group incoming network packets with the system's knowledge base. The knowledge base contains packets from the authorized connections as well as packets from known intrusions. We choose OPTICS clustering to group the packets together. We decide whether the incoming packet is an intrusion or not based on the cluster it falls into. We also aim to increase detection rates of the current known intrusions. We also compare detection rates if information about the known intrusions are presented to IDS. This can help identify new and novel intrusions that are not present in the system. We determine whether these information about the intrusions are significant or not. Upon observation of the results, the OPTICS algorithm have correctly ordered the packets together. The detection rates and false positive rates depends on the amount of prior attack information in the knowledge base. Inclusion of intrusion packets with the same type gives the highest detection rate.</subfield>
  </datafield>
  <datafield tag="650" ind1=" " ind2="0">
   <subfield code="a">Intrusion detection systems (Computer security)</subfield>
  </datafield>
  <datafield tag="700" ind1="1" ind2=" ">
   <subfield code="a">Festin, Susan P.</subfield>
   <subfield code="e">adviser.</subfield>
  </datafield>
  <datafield tag="842" ind1=" " ind2=" ">
   <subfield code="a">Thesis</subfield>
  </datafield>
  <datafield tag="905" ind1=" " ind2=" ">
   <subfield code="a">FI</subfield>
  </datafield>
  <datafield tag="905" ind1=" " ind2=" ">
   <subfield code="a">UP</subfield>
  </datafield>
  <datafield tag="852" ind1="0" ind2=" ">
   <subfield code="a">UPD</subfield>
   <subfield code="b">DARCHIVES</subfield>
   <subfield code="h">LG 995 2015 C65</subfield>
   <subfield code="i">D45</subfield>
  </datafield>
  <datafield tag="852" ind1="0" ind2=" ">
   <subfield code="a">UPD</subfield>
   <subfield code="b">DENG-II</subfield>
   <subfield code="h">LG 995 2015 C65</subfield>
   <subfield code="i">D45</subfield>
  </datafield>
  <datafield tag="942" ind1=" " ind2=" ">
   <subfield code="a">Thesis</subfield>
  </datafield>
 </record>
</collection>
