A fast anomaly detection system using probabilistic artificial immune algorithm capable of learning new attacks

Shon T, Moon J (2007) A hybrid machine learning approach to network anomaly detection. Inf Sci 177:3799–3821 Zhou Z, Leckie C, Karunasekera S (2010) A survey of coordinated attacks and collaborative intrusion detection. Comput Security 29:124–140 Teodoro P, Verdejo J, Fernandez G, Va′zquez E (2009) Anomaly-based network intrusion detection: techniques, systems and challenges. Comput Secuity 28:18–28 Axelsson S (1999) Research in intrusion detection systems: a survey. Technical Report TR 98-17. Chalmers University of Technology, Goteborg, Sweden Debar H, Dacier M, Wespi A (2000) A revised taxonomy for intrusion detection systems. Ann Télécommun 55(7–8):361–378 Masri W, Podgurski A (2008) Application-based anomaly intrusion detection with dynamic information flow analysis. Comput Security 27:176–187 Twycross J, Aickelin U (2006) Libtissue—implementing innate immunity. In: Aickelin U (ed) Proceedings of the IEEE congress on evolutionary, computation (CEC’06). Vancouver, Canada, pp 16–21 Luther K, Bye R, Alpcan T, Muller A, Albayrak S (2007) A cooperative ais framework for intrusion detection. In: IEEE international conference on communications (ICC’07), Glasgow, Scotland, 4–28 June 2007, pp 1409–1416 Kim J (2003) Integrating artificial immune algorithms for intrusion detection, PhD Thesis, Department of Computer Science, University College London Kim J, Bentley P (2002) Towards an artificial immune system for network intrusion detection: an investigation of dynamic clonal selection. In: Fogel DB, El-Sharkawi MA, Yao X, Greenwood G, Iba H, Marrow P, Shackleton M (eds) Proceedings of the IEEE congress on evolutionary computation (CEC’02), vol 2, Honolulu, HI, USA, 12–17 May 2002. IEEE Press, pp 1015–1020 Liu F, Qu B, Chen R (2004) Intrusion detection based on immune clonal selection algorithms. In: Webb GI, Yu X (eds) AI 2004: advances in artificial intelligence, volume 3339 of lecture notes in computer science. Springer, Berlin, pp 1226–1232 Xian J, Lang F, Tang X (2005) A novel intrusion detection method based on clonal selection clustering algorithm. In: Proceedings of 2005 international conference on machine learning and cybernetics, vol 6, 18–21 August 2005, pp 3905–3910 Ye N, Emran S, Chen Q, Vilbert S (2002) Multivariate statistical analysis of audit trails for host-based intrusion detection. IEEE Trans Comput 51(7):810–820 Kerkar R, Srinivas S (2009) Knowledge-based systems. Jones & Bartlett Publishers, Sudbury Burbeck K, Tehrani A (2004) Adwice—anomaly detection with real-time incremental clustering. Inf Security Cryptol 3506:407–424 Borah B, Bhattacharyya D (2008) Catsub: a technique for clustering categorical data based on subspace. J Comput Sci 2:7–20 Khan L, Awad M, Thuraisingham B (2007) A new intrusion detection system using support vector machines and hierarchical clustering. Int J Very Large Data Bases 16:507–552 Gaddam S, Phoha V, Balagani K (2007) K-means + id3: a novel method for supervised anomaly detection by cascading k-means clustering and id3 decision tree learning methods. IEEE Trans Knowl Data Eng 19(3):345–354 Holland J (1975) Adaptation in natural and artificial systems. University of Michigan Press, Ann Arbor Glover F (1977) Heuristic for integer programming using surrogate constraints. Decis Sci 8(1):156–166 Kirkpatrick S, Gelatt C, Vecchi M (1983) Optimization by simulated annealing. Science 220:671–680 Mohammadi M, Raahemi R, Akbari A, Nassersharif B, Moeinzadeh H (2011) Improving linear discriminant analysis with artificial immune system-based evolutionary algorithms. Inf Sci 189:219–232 Zhao W, Davis W (2011) A modified artificial immune system based pattern recognition approach an application to clinical diagnostics. Artif Intell Med 52(1):1–9 Polat K, Güneş S, Tosun S (2006) Diagnosis of heart disease using artificial immune recognition system and fuzzy weighted pre-processing. Pattern Recogn 39(11):2186–2193 Zhou J, Dasgupta D (2004) Real-valued negative selection algorithm with variable-sized detectors, LNCS 3102. In: Proceedings of GECCO, pp 287–298 Bolón-Canedo V, Sánchez-Maroño N, Betanzos A (2011) Feature selection and classification in multiple class datasets: an application to KDDCup99 dataset. Expert Syst Appl 38(5):5947–5957 Tsai C, Lin C (2010) A triangle area based nearest neighbors approach to intrusion detection. Pattern Recognit 43(1):222–229 Toosi AN, Kahani M (2007) A new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers. Comput Commun 30(10):2201–2212 Mahbod T, Ebrahim B, Wei L, Ali AG (2009) A detailed analysis of the KDD CUP 99 data set in proceeding of computational intelligence in security and defense application McHugh J (2000) Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by Lincoln laboratory. ACM Trans Inf Syst Security 3:262–294 Botta A, Dainotti A, Pescapè A (2012) A tool for the generation of realistic network workload for emerging networking scenarios. Comput Netw 56(15):3531–3547 Asgharian Z, Asgharian H, Akbari A, Raahemi B (2011) A framework for SIP intrusion detection and response systems. Computer networks and distributed systems (CNDS), pp 100–105 Asgharian Z, Asgharian H, Akbari A, Raahemi B (2012) Detecting denial of service attacks on sip based services and proposing solutions. Intrusion Detect Response Technol Protect Netw 6:145–167 Nassar M, State R, Festor O (2010) Labeled VoIP data-set for intrusion detection evaluation. Conference on Networked services and applications: engineering, control and management (EUNICE’10), pp 97–106 Nassar M, State R, Festor O (2008) Monitoring SIP traffic using support vector machines. In: Proceedings of the 11th international symposium on recent advances in intrusion detection (RAID ‘08), pp 311–330 Nassar M, State R, Festor O (2009) VoIP malware: attack tool & attack scenarios, ICC ‘09. IEEE international conference on communications, pp 1–6 Dunn J (1973) A fuzzy relative of the isodata process and its use in detecting compact well-separated clusters. J Cybern 3:32–57 Mohammadi M, Raahemi B, Akbari A. Unsupervised sample reduction using clustering for intrusion detection system. Technical Report, Knowledge Discovery and Data mining Lab. University of Ottawa. http://web5.uottawa.ca/www5/braahemi/publications.htm/Sample-Reduction.pdf NSL-KKD dataset is available at: http://iscx.ca/NSL-KDD/ last visit: May 2012 “Nmap”. http://nmap.org/download.html last visit: May 2012 “PacketStorm”. http://packetstormsecurity.org last visit: May 2012 “Libsvm,” http://www.csie.ntu.edu.tw/cjlin/libsvm/.last visit: May 2012 “DataSets”. http://nrg.iust.ac.ir/index.php/research. Last visit August 2013