Abstract:Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico (lpr) and from KLINNS Lab of Xi'an Jiaotong University (ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.

Medical big data intrusion detection system based on virtual data analysis from assurance perspective

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Medical Big Data Analysis In Hospital Information System

Multi-agent based hybrid Intrusion detection system

Research on Data Mining-based Intrusion Detection in Real-time Environment

Research on Computer Database Intrusion Detection Technology Based on Virtualization Technology

Detecting the penetration of malicious behavior in big data using hybrid algorithms

A Privacy Risk Assessment Model for Medical Big Data Based on Adaptive Neuro-Fuzzy Theory

Cybersecurity of Medical Data Based on Big Data and Privacy Protection Method

A Practical Model Based on Anomaly Detection for Protecting Medical IoT Control Services Against External Attacks

A medical big data access control model based on fuzzy trust prediction and regression analysis

Computer Network Information System Security Prevention Methods under the Background of Big Data

Computer Network Information Security Monitoring System Based on Big Data Era

A privacy preserve big data analysis system for wearable wireless sensor network

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

A privacy protection method for health care big data management based on risk access control

Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection

An intrusion detection system for health-care system using machine and deep learning

Medical Sports Data Privacy Protection Method Based on Legal Risk Control

Hybrid Intrusion Detection Based on Data Mining

A Practical Study of Big Data Technology in Computer Network Information Security Processing