Toward zero-day attack identification using linear data transformation techniques

Ahmed Aleroud, George Karabatis

Research output: Contribution to conferencePaperpeer-review

17 Scopus citations

Abstract

Intrusion Detection Systems (IDSs) have been developed for many years, but in general they fall short in efficiently detecting zero-day attacks. A promising approach to this problem is to apply linear data transformation and anomaly detection techniques on top of known attack signatures that convey contextual properties. The linear data transformation technique relies on several discriminant functions, which are used to calculate the estimated probability of zero-day attacks by analyzing network connection features. The anomaly detection technique identifies zero-day attacks using the One Class Nearest Neighbor (1-class NN) algorithm, which has been applied using Singular Value Decomposition (SVD) technique to achieve dimensionality reduction. An experimental prototype has been implemented to evaluate these techniques using data from the NSL-KDD intrusion detection dataset. The results indicate that linear data transformation techniques are quite effective and efficient in detecting zero-day attacks.

Original languageEnglish (US)
Pages159-168
Number of pages10
DOIs
StatePublished - 2013
Externally publishedYes
Event7th International Conference on Software Security and Reliability, SERE 2013 - Gaithersburg, MD, United States
Duration: Jun 18 2013Jun 20 2013

Conference

Conference7th International Conference on Software Security and Reliability, SERE 2013
CountryUnited States
CityGaithersburg, MD
Period6/18/136/20/13

Keywords

  • contextual information
  • Intrusion detection
  • misuse detection
  • one class nearest neighbor
  • zero-day attack

ASJC Scopus subject areas

  • Software
  • Safety, Risk, Reliability and Quality

Fingerprint Dive into the research topics of 'Toward zero-day attack identification using linear data transformation techniques'. Together they form a unique fingerprint.

Cite this