An Effective TCM-KNN Scheme for High-Speed Network Anomaly Detection

Transcription

1 Vol. 24, November,, 200 An Effecve TCM-KNN Scheme for Hgh-Speed Nework Anomaly eecon Yang L Chnese Academy of Scences, Bejng Chna, lyang@sofware.c.ac.cn Absrac. Nework anomaly deecon has been a ho opc n he pas years. However, hgh false alarm rae, dffcules n obanng exac clean daa for he modelng of normal paerns and he deeroraon of deecon rae because of unclean ranng se always make no as good as we expec. Therefore, we propose a novel daa mnng mehod for nework anomaly deecon n hs paper. Expermenal resuls on he well-known K Cup 999 daase demonsrae can effecvely deec anomales wh hgh rue posves, low false posves as well as wh hgh confdence han he sae-of-he-ar anomaly deecon mehods. Furhermore, even provded wh no purely clean daa (unclean daa), he proposed mehod s sll robus and effecve. Keywords: nework secury, anomaly deecon, daa mnng, TCM-KNN Inroducon As an mporan branch of nruson deecon feld, anomaly deecon has been an acve area of research n nework secury snce was orgnally proposed by ennng []. A lo of daa mnng mehods have been proposed for hs hospo [2]. Anomaly deecon algorhms have he advanage over msuse deecon ha hey can deec new ypes of nrusons as devaons from normal usage. In hs problem, gven a se of normal daa o ran from, and gven a new pece of es daa, he goal of he nruson deecon algorhm s o deermne wheher he es daa belong o normal or o an anomalous behavor. However, anomaly deecon mehods suffer from a hgh rae of false alarms. Ths occurs prmarly because prevously unseen (ye legmae) sysem behavors are also recognzed as anomales, and hence flagged as poenal nrusons. Moreover, f he ranng se s conamnaed by he nosy daa, he deecon performance of anomaly deecon mehods would deerorae sharply. In hs paper, we presen a novel daa mnng mehod for nework anomaly deecon. I s based on TCM-KNN (Transducve Confdence Machnes for K-Neares Neghbors) algorhm, whch s successfully appled o paern recognon, fraud deecon and ouler deecon [6], [7]. The mos dsngushed characersc for s ha need no consruc a classfer as he radonal daa mnng mehods and s mmune o he effec of nosy daa n ranng daase, herefore, has beer deecon performance han he radonal anomaly deecon mehods n pracce. A seres of expermens on he wellknown K Cup 999 daase demonsrae our mehod has hgher deecon rae (also named rue posve raes) and lower false alarm (also named false posve raes) han he sae-of-he-ar anomaly deecon mehods. Furhermore, holds good performance even nferred by he nosy daa n ranng se.

2 Vol. 24,, No. 2, November,, TCM-KNN Algorhm Transducve Confdence Machnes (TCM) nroduced he compuaon of he confdence usng algorhmc randomness heory [5]. Unlke radonal mehods n daa mnng, ransducon can offer measures of relably o ndvdual pons, and uses very broad assumpons excep for he d assumpon (he ranng as well as new (unlabelled) pons are ndependenly and dencally dsrbued). There exss a unversal mehod of fndng regulares n daa sequences. Ths p-value serves as a measure of how well he daa suppors or no a null hypohess (he pon belongs o a ceran class). The smaller he p-value, he greaer he evdence agans he null hypohess (.e., he pon s an ouler wh respec o he curren avalable classes). Users of ransducon as a es of confdence have approxmaed a unversal es for randomness (whch s n s general form, non-compuable) by usng a p-value funcon called srangeness measure [4]. The general dea s ha he srangeness measure corresponds o he uncerany of he pon beng measured wh respec o all he oher labeled pons of a class. {(, ),..., (, n )} Imagne we have a nruson deecon ranng se x y x y n, of n elemens, 2 n X {,,..., } where = x x x s he se of feaure values (such as he connecon duraon me, he packe lengh, ec.) exraced from he raw nework packe (or nework flow such as TCP flow) for pon y and s he classfcaon for pon, akng values from a fne se of possble classfcaons (such as normal, os aack, Probe aack, ec.), {,2,3,..., c } whch we denfy as. We also have a es se of s pons smlar o he ones n he ranng se, our goal s o assgn o every es pon one of he possble classfcaons. For every classfcaon we also wan o gve some confdence measures. In hs paper, we combne K-Neares Neghbors (KNN) algorhm wh TCM for TCM- KNN algorhm and s noed ha TCM can be combned wh any oher daa mnng mehods such as SVM. We denoe he sored sequence (n ascendng order) of he dsances of pon from he oher pons wh he same classfcaon y y as y. Also, wll sand for he jh shores dsance n hs sequence and for he sored sequence of dsances conanng pons wh classfcaon dfferen from y. We assgn o every pon a measure called he ndvdual srangeness measure. Ths measure defnes he srangeness of he pon n relaon o he res of he pons. In our case he srangeness measure for a pon wh label y s defned as k y j= j y = k y j= j where k s he number of neghbors used. Thus, our measure for srangeness s he rao of he sum of he k neares dsances from he same class o he sum of he k neares dsances from all oher classes. Ths s a naural measure o use, as he srangeness of a pon ncreases when he dsance from he pons of he same class becomes bgger or when he dsance from he oher classes becomes smaller. Provded wh he defnon of srangeness, we wll use equaon (2) o compue he p- value as follows: #{ : } p( ) = n+ where # denoes he cardnaly of he se, whch s compued as he number of elemens n fne se. s he srangeness value for he es pon (assumng here s only one es pon, or ha he es pons are processed one a a me), s a vald randomness es n he () (2) y j 2

3 Vol. 24, November,, 200 d case. The proof akes advanage of he fac ha snce our dsrbuon s d, all permuaons of a sequence have he same probably of occurng. If we have a sequence {, 2,..., m} and a new elemen s nroduced hen can ake any place n he new (sored) sequence wh he same probably, as all permuaons of he new sequence are equprobable. Thus, he probably ha s among he j larges occurs wh probably of a mos. j n+ 3 Anomaly eecon Framework Based on TCM-KNN Algorhm In sandard TCM-KNN, we are always sure ha he pon we are examnng belongs o one of he classes. However, n anomaly deecon, we need no assgn a pon consruced from he nework packes o a ceran class, we only aemp o pnpon he pon n queson s normal or abnormal. Therefore, we propose o use a modfed defnon of as follows: k y y = j= (3) j Ths new defnon wll make he srangeness value of a pon far away from he class consderably larger han he srangeness of pons already nsde he class. Wh respec o our anomaly deecon ask, here are no classes avalable, hen he above es can be admnsered o he daa as a whole ( all belonged o one class - normal). Therefore, only requres a sngle per pon (as opposed o compung one per class), and he τ used drecly reflecs he confdence level ( τ ) s requred. The process of our new smplfed TCM-KNN algorhm for anomaly deecon s depced n Fgure : Parameers: k(he neares neghbors o be used), m (sze of ranng daase), τ (prese hreshold), r(nsance o be deermned) for = o m { calculae y accordng o equaon () for each one n ranng daase and sore; calculae srangeness accordng o equaon (3) for each one n ranng daase and sore; } calculae he srangeness for r accordng o equaon (3); calculae he p-values for r accordng o equaon (2); f ( p τ) deermne r as anomaly wh confdence τ and reurn; else clam r s normal wh confdence τ and reurn; 3

4 Vol. 24,, No. 2, November,, 200 Fg.. Pseudocode of he TCM-KNN algorhm for anomaly deecon Fgure 2 shows us an anomaly deecon framework based on TCM-KNN algorhm and clearly llusraes how o apply he proposed mehod o he realsc anomaly deecon scenaro. The framework ncludes wo phases: ranng phase and deecon phase. In he frs phase, hree mporan jobs should be consdered: a) aa collecon for modelng: represenave daa for normal nework behavors should be colleced for our mehod o modelng. I s worh nong here ha as anomaly deecon, aack daa s no need for us o collec. b) Feaure selecon & vecorlzaon: o mee he requremen of TCM-KNN whch manly depends on he dsance calculaon based on vecors, feaure selecon and vecorlzaon work should be employed. For nsances, he duraon me of a TCP connecon, he rao beween he number of SYN packes, ec. mgh be seleced for he feaures. They are mosly he same as hose n K Cup 999 daase whose connecons mea nformaon have been exraced as 4 feaures. c) Modelng by TCM-KNN algorhm: for he las sep, TCM-KNN algorhm nroduced n hs paper hen calculaes he srangeness and p-value for each nsance n he ranng daase as dscussed n Fgure, hus o consruc he anomaly deecon engne. For he deecon phase, all he real-me daa colleced from he nework also should be preprocessed o vecors accordng o he seleced feaures havng been acqured n ranng phase, hen would be dreced o he anomaly deecon engne based on TCM- KNN, bengn or malcous raffc would be deermned. aa collecon aa preprocess Anomaly deecon based on TCM-KNN eecon phase Tranng phase aa collecon for modelng Feaure selecon & vecorlze Normal daase (Baselne) Fg. 2. Anomaly eecon Framework Based on TCM-KNN 4 Expermenal Resuls 4. aase and Preprocess In our expermens, we selec he well-known K Cup 999 daase (K 99) [8] as our es daase. I ncludes connecons nformaon summarzed from he orgnal TCP dump fles. A connecon s a sequence of TCP packes sarng and endng a some well defned mes, beween whch daa flows o and from a source IP address o a arge IP address under some well defned proocol. Each connecon s labeled as eher normal, or 4

5 Vol. 24, November,, 200 as an aack, wh exacly one specfc aack ype. Each connecon record consss of abou 00 byes. The aacks conan 24 dfferen ypes of aacks ha are broadly caegorzed n four groups such as Probes, os (enal of Servce), U2R (User o Roo) and R2L (Remoe o Local). Before begnnng our expermens, we preprocessed he daase. Frs, we normalzed he daase. For he numercal daa, n order o avod one arbue wll domnae anoher arbue, hey were normalzed by replacng each arbue value wh s dsance o he mean of all he values for ha arbue n he nsance space. For dscree or caegorcal daa, we represen a dscree value by s frequency. Tha s, dscree values of smlar frequency are close o each oher, bu values of very dfferen frequency are far apar. As a resul, dscree arbues are ransformed o connuous arbues. 4.2 Expermenal Resuls In he conras expermens beween TCM-KNN and he mos dsngushed anomaly deecon mehods proposed by auhors n [3], we used he sampled nosy daase for ranng and es ( ncludes 2048 normal nsances and 870 aack nsances). We adoped enfold cross-valdaon approach o make he expermen. For he unsupervsed anomaly deecon algorhms, we se her parameers as he same n [3] for he convenence of comparson. For our TCM-KNN, k s se 50 and τ 0.05 (herefore, he confdence level s 0.95). Fgure 3 shows he comparson resuls of hem. I s clear ha our mehod demonsraes hgher TP and especally he lower FP han he oher hree mehods. Moreover, we also use boh clean daase and unclean daase for ranng, o es he adapve performance of our TCM-KNN algorhm. The resul s depced n Table. I clearly shows ha a lle dfference can be observed when we use he wo ypes of ranng daase. I srongly demonsraes he proposed TCM-KNN mehod can be a good canddae for anomaly deecon n realsc nework envronmen han he oher hree mehods, because acqurng purely clean daase for ranng s ofen mpossble and he relavely unclean daase s reasonable. Therefore, a robus deecon performance n such a nosy nework envronmen s a necessy for anomaly deecon mehod. The resuls demonsrae our TCM-KNN mehod has such a good performance. Fgure 3. eecon performance comparson resuls beween TCM-KNN and he oher hree dsngushed anomaly deecon mehods. The lef bar for each mehod denoes TP (rue posve raes) and he rgh one denoes FP (false posve raes). 5

6 Vol. 24,, No. 2, November,, 200 Table. Runnng resuls usng boh clean and unclean ranng daase clean daase unclean daase TP 99.44% 99.42% FP.74% 2.37% 5 Conclusons and Fuure Work In hs paper, we propose a novel anomaly deecon mehod based on TCM-KNN daa mnng algorhm. Expermenal resuls demonsrae s effecveness and advanages over radonal unsupervsed anomaly deecon mehods. As our prelmnary work, a lo of work should be mproved n he fuure. Among hem, how o reduce he compuaonal cos of TCM-KNN s he mos mporan one. aa reducon and feaure selecon wll be focused around and hereafer he real applcaon of TCM-KNN for anomaly deecon would be carred ou. References [] ennng,.e.: An Inruson eecon Model. IEEE Transacons on Sofware Engneerng. (987) [2] Lee, W., Solfo, S. J.: aa Mnng Approaches for Inruson eecon. Proceedngs of he 998 USENIX Secury Symposum. (998) [3] Eskn, E., Arnold, A., Prerau, M., Pornoy, L., Solfo, S. J.: A Geomerc Framework for Unsupervsed Anomaly eecon: eecng Inrusons n Unlabeled aa. In. Barbara and S. Jajoda (edors), Applcaons of aa Mnng n Compuer Secury, Kluwer (2002) [4] Gammerman, A., Vovk, V.: Predcon algorhms and confdence measure based on algorhmc randomness heory. Theorecal Compuer Scence. (2002) [5] L, M., Vany, P.: Inroducon o Kolmogorov Complexy and s Applcaons. 2 nd Edon, Sprnger Verlag. (997) [6] Proedru, K., Nourednov, I., Vovk, V., Gammerman, A.: Transducve confdence machne for paern recognon. Proc. 3h European conference on Machne Learnng. (2002) [7] anel Barbará, Carloa omencon, James P. Rogers: eecng oulers usng ransducon and sascal esng. In: Proceedngs of he 2h ACM SIGK nernaonal conference on Knowledge dscovery and daa mnng. USA (2006) [8] Knowledge dscovery n daabases ARPA archve. Task escrpon [9] hp:// 6