Learning intrusion detection: supervised or unsupervised? (2005)
| Venue: | IN: IMAGE ANALYSIS AND PROCESSING, PROC. OF 13TH ICIAP CONFERENCE. (2005) 50–57 |
| Citations: | 20 - 1 self |
BibTeX
@INPROCEEDINGS{Laskov05learningintrusion,
author = {Pavel Laskov and Patrick Düssel and Christin Schäfer and Konrad Rieck},
title = { Learning intrusion detection: supervised or unsupervised?},
booktitle = {IN: IMAGE ANALYSIS AND PROCESSING, PROC. OF 13TH ICIAP CONFERENCE. (2005) 50–57},
year = {2005},
pages = {50--57},
publisher = {Springer}
}
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Application and development of specialized machine learning techniques is gaining increasing attention in the intrusion detection community. A variety of learning techniques proposed for different intrusion detection problems can be roughly classified into two broad categories: supervised (classification) and unsupervised (anomaly detection and clustering). In this contribution we develop an experimental framework for comparative analysis of both kinds of learning techniques. In our framework we cast unsupervised techniques into a special case of classification, for which training and model selection can be performed by means of ROC analysis. We then investigate both kinds of learning techniques with respect to their detection accuracy and ability to detect unknown attacks.
