Identifying Intrusions in Computer Networks with Principal Component Analysis

Most current anomaly Intrusion Detection Systems (IDSs) detect computer network behavior as normal or abnormal but cannot identify the type of attacks. Moreover, most current intrusion detection methods cannot process large amounts of audit data for real-time operation. In this paper, we propose a novel method for intrusion identification in computer networks based on Principal Component Analysis (PCA). Each network connection is transformed into an input data vector. PCA is employed to reduce the dimensionality of the data vectors and identification is handled in a low dimensional space with high efficiency and low use of system resources. The normal behavior is profiled based on normal data for anomaly detection and models of each type of attack are built based on attack data for intrusion identification. The distance between a vector and its reconstruction onto those reduced subspaces representing the different types of attacks and normal activities is used for identification...

• Type: Conference
• Year: 2006
• Where: IEEEARES
• Authors: Wei Wang, Roberto Battiti
• Keywords: IEEEARES 2006, Intrusion Detection, Intrusion Detection Systems, Intrusion Identification, Security Privacy