Abstract:Organizations such as government departments and financial institutions provide online service facilities accessible via an increasing number of internet connected devices which make their operational environment vulnerable to cyber attacks. Consequently, there is a need to have mechanisms in place to detect cyber security attacks in a timely manner. A variety of Network Intrusion Detection Systems (NIDS) have been proposed and can be categorized into signature-based NIDS and anomaly-based NIDS. The signature-based NIDS, which identify the misuse through scanning the activity signature against the list of known attack activities, are criticized for their inability to identify new attacks (never-before-seen attacks). Among anomaly-based NIDS, which declare a connection anomalous if it expresses deviation from a trained model, the unsupervised learning algorithms circumvent this issue since they have the ability to identify new attacks. In this study, we use an unsupervised learning algorithm based on principal component analysis to detect cyber attacks. In the training phase, our approach has the advantage of also identifying outliers in the training dataset. In the monitoring phase, our approach first identifies the affected dimensions and then calculates an anomaly score by aggregating across only those components that are affected by the anomalies. We explore the performance of the algorithm via simulations and through two applications, namely to the UNSW-NB15 dataset recently released by the Australian Centre for Cyber Security and to the well-known KDD'99 dataset. The algorithm is scalable to large datasets in both training and monitoring phases, and the results from both the simulated and real datasets show that the method has promise in detecting suspicious network activities.

Identifying Intrusions in Computer Networks with Principal Component Analysis

A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security

A Hierarchical Intrusion Detection Model Based on the PCA Neural Networks

Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection

Deceptive attack detection of control system using multi-scale principal component analysis

An adaptive network intrusion detection method based on PCA and support vector machines

Implement an Intrusion Detection System Utilizing Machine Learning and Principal Component Analysis

Intrusion detection algorithm based on improved principal component analysis

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

Detection of cybersecurity attacks through analysis of web browsing activities using principal component analysis

The abnormal traffic detection scheme based on PCA and SSH

Building Efficient Intrusion Detection Model Based on Principal Component Analysis and C4.5

Intrusion Detection Model Based on Support Vector Regression and Principal Components Analysis

Kernel Pca Based Network Intrusion Feature Extraction and Detection Using Svm

Supervised Pca Neural Networks For Anomaly And Misuse Detection

Intrusion detection using PCASOM neural networks

Principal Component Analysis of Network Security Data Based on Projection Pursuit

One-class Intrusion Detection System Based on KPCA Space-Similarity

Intrusion Detection Feature Selection Method Based on Principal Component Analysis

In-network PCA and anomaly detection

An Intrusion Detection Method Based on Principal Component Analysis and Decision Tree