Anomaly-based network intrusion detection: Techniques, systems and challenges

LOF: identifying density-based local outliers

Breunig, M. M., Kriegel, H.-P., Ng, R. T., & Sander, J. (2000) · ACM SIGMOD Record · doi:10.1145/335191.335388 · Cited by 5,207 · see citing works

Fast Effective Rule Induction

Cohen, W. W. (1995) · Elsevier eBooks · doi:10.1016/b978-1-55860-377-6.50023-2 · Cited by 3,890 · see citing works

An Intrusion-Detection Model

Denning, D. E. (1987) · IEEE Transactions on Software Engineering · doi:10.1109/tse.1987.232894 · Cited by 3,428 · see citing works

Outliers in Statistical Data

BARNETT, V. D., Lewis, T., & Abeles, F. F. (1979) · Physics Today · doi:10.1063/1.2995737 · Cited by 2,834 · see citing works

The KDD process for extracting useful knowledge from volumes of data

Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996) · Communications of the ACM · doi:10.1145/240455.240464 · Cited by 1,934 · see citing works

Outliers in Statistical Data.

Atkinson, A. C., BARNETT, V. D., & Lewis, T. (1995) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.2307/2983451 · Cited by 1,688 · see citing works

A Tutorial on Learning with Bayesian Networks

Heckerman, D. E. (1998) · Springer eBooks · doi:10.1007/978-94-011-5014-9_11 · Cited by 1,242 · see citing works

Outliers in Statistical Data.

Balakrishnan, N., Barnett, V., & Lewis, T. (1995) · Biometrics · doi:10.2307/2533352 · Cited by 1,228 · see citing works

Data Mining Approaches for Intrusion Detection

Lee, W., & Stolfo, S. J. (2000) · doi:10.21236/ada401496 · Cited by 1,186 · see citing works

The 1999 DARPA off-line intrusion detection evaluation

Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877 · see citing works

Use of K-Nearest Neighbor classifier for intrusion detection

Liao, Y., & Vemuri, V. R. (2002) · Computers & Security · doi:10.1016/s0167-4048(02)00514-x · Cited by 809 · see citing works

Intrusion detection with unlabeled data using clustering

Portnoy, L. (2000) · doi:10.7916/d8mp5904 · Cited by 756 · see citing works

Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection

Ptacek, T., & Newsham, T. N. (1998) · Cited by 655 · see citing works

The base-rate fallacy and the difficulty of intrusion detection

Axelsson, S. (2000) · ACM Transactions on Information and System Security · doi:10.1145/357830.357849 · Cited by 640 · see citing works

Cost-based modeling for fraud and intrusion detection: results from the JAM project

Stolfo, S. J., Fan, W., Lee, W., Prodromidis, A. L., & Chan, P. K. (2002) · DARPA Information Survivability Conference and Exposition · doi:10.1109/discex.2000.821515 · Cited by 621 · see citing works

An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection

Mahoney, M. V., & Chan, P. K. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45248-5_13 · Cited by 536 · see citing works

A neural network component for an intrusion detection system

Debar, H., Becker, M., & Siboni, D. (2003) · IEEE Computer Society Symposium on Research in Security and Privacy · doi:10.1109/risp.1992.213257 · Cited by 462 · see citing works

Specification-based anomaly detection

Sekar, R., Gupta, A. K., Frullo, J., et al. (2002) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/586110.586146 · Cited by 369 · see citing works

Host-based intrusion detection using dynamic and static behavioral models

Yeung, D., & Ding, Y. (2002) · Pattern Recognition · doi:10.1016/s0031-3203(02)00026-2 · Cited by 350 · see citing works

Bayesian event classification for intrusion detection

Kruegel, C., Mutz, D. H., Robertson, W., & Valeur, F. (2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2003.1254306 · Cited by 344 · see citing works

The base-rate fallacy and its implications for the difficulty of intrusion detection

Axelsson, S. (1999) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/319709.319710 · Cited by 327 · see citing works

Learning nonstationary models of normal network traffic for detecting novel attacks

Mahoney, M. V., & Chan, P. K. (2002) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775047.775102 · Cited by 322 · see citing works

Prefix-preserving IP address anonymization: measurement-based security evaluation and a new cryptography-based scheme

Fan, J., Xu, J. J., Ammar, M., et al. (2004) · Computer Networks · doi:10.1016/j.comnet.2004.03.033 · Cited by 289 · see citing works

Multivariate statistical analysis of audit trails for host-based intrusion detection

Ye, N., Emran, S. M., Chen, Q., et al. (2002) · IEEE Transactions on Computers · doi:10.1109/tc.2002.1017701 · Cited by 287 · see citing works

Using Genetic Algorithm for Network Intrusion Detection

Li, W. (2004) · Cited by 260 · see citing works

Intrusion Detection: A Survey

Lazarević, A. M., Kumar, V., & Srivastava, J. (2005) · Springer eBooks · doi:10.1007/0-387-24230-9_2 · Cited by 245 · see citing works

Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation

Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Lecture notes in computer science · doi:10.1007/3-540-39945-3_11 · Cited by 237 · see citing works

Stateful intrusion detection for high-speed network's

Kruegel, C., Valeur, F., Vigna, G., et al. (2005) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/secpri.2002.1004378 · Cited by 237 · see citing works

FUZZY DATA MINING AND GENETIC ALGORITHMS APPLIED TO INTRUSION DETECTION

Bridges, S. M. (2002) · Cited by 235 · see citing works

ADMIT

Sequeira, K., & Zaki, M. J. (2002) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775047.775103 · Cited by 229 · see citing works

RESEARCH ON INTRUSION DETECTION AND RESPONSE: A SURVEY

Kabiri, P., & Ghorbani, A. A. (2005) · doi:10.6633/ijns.200509.1(2).05 · Cited by 220 · see citing works

Detecting Anomalous Network Traffic with Self-organizing Maps

Ramadas, M., Ostermann, S., & Tjaden, B. C. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45248-5_3 · Cited by 212 · see citing works

Fuzzy network profiling for intrusion detection

Dickerson, J. E., & Dickerson, J. A. (2002) · doi:10.1109/nafips.2000.877441 · Cited by 210 · see citing works

Anomaly detection methods in wired networks: a survey and taxonomy

Tapiador, J., García‐Teodoro, P., & Dı́az-Verdejo, J. E. (2004) · Computer Communications · doi:10.1016/j.comcom.2004.07.002 · Cited by 169 · see citing works

A methodology for testing intrusion detection systems

Puketza, N., Zhang, K., Chung, M. K., Mukherjee, B., & Olsson, R. A. (1996) · IEEE Transactions on Software Engineering · doi:10.1109/32.544350 · Cited by 165 · see citing works

Evaluation of intrusion detectors: a decision theory approach

Gaffney, J. E., & Ulvila, J. W. (2002) · doi:10.1109/secpri.2001.924287 · Cited by 128 · see citing works

Learning nonstationary models of normal network traffic for detecting novel attacks

Mahoney, M. V., & Chan, P. K. (2002) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775094.775102 · Cited by 112 · see citing works

Proceedings. 20th Annual Computer Security Applications Conference

(2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2004.12 · Cited by 105 · see citing works

Identifying intrusions in computer networks with principal component analysis

Wang, W., & Battiti, R. (2006) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2006.73 · Cited by 103 · see citing works

LARIAT: Lincoln adaptable real-time information assurance testbed

Rossey, L. M., Cunningham, R. K., Fried, D. J., et al. (2003) · Proceedings - IEEE Aerospace Conference · doi:10.1109/aero.2002.1036158 · Cited by 92 · see citing works

Wired and wireless intrusion detection system: Classifications, good characteristics and state-of-the-art

Sobh, T. S. (2005) · Computer Standards & Interfaces · doi:10.1016/j.csi.2005.07.002 · Cited by 84 · see citing works

A software platform for testing intrusion detection systems

Puketza, N., Chung, M. K., Olsson, R. A., et al. (1997) · IEEE Software · doi:10.1109/52.605930 · Cited by 78 · see citing works

Intrusion detection testing and benchmarking methodologies

Athanasiades, N., Abler, R. T., Levine, J. G., et al. (2003) · doi:10.1109/iwias.2003.1192459 · Cited by 70 · see citing works

The 1998 Lincoln Laboratory IDS Evaluation

McHugh, J. (2000) · Lecture notes in computer science · doi:10.1007/3-540-39945-3_10 · Cited by 65 · see citing works

Stochastic protocol modeling for anomaly based network intrusion detection

Tapiador, J., García‐Teodoro, P., & Dı́az-Verdejo, J. E. (2003) · doi:10.1109/iwias.2003.1192454 · Cited by 53 · see citing works

Detection of Web-Based Attacks through Markovian Protocol Parsing

Tapiador, J., García‐Teodoro, P., & Dı́az-Verdejo, J. E. (2005) · Proceedings - IEEE Symposium on Computers and Communications/IEEE Symposium on Computers and Communications · doi:10.1109/iscc.2005.51 · Cited by 52 · see citing works

Managing Cyber Threats: Issues, Approaches, and Challenges (Massive Computing)

Kumar, V., Srivastava, J., & Lazarević, A. M. (2005) · Springer eBooks · Cited by 41 · see citing works

The computer science laboratory

Eckhouse, R. H. (1972) · doi:10.1145/800155.805001 · Cited by 27 · see citing works

The Common Intrusion Detection Framework - Data Formats

Feiertag, R. J., Kahn, C., Schnackenberg, D., et al. (1998) · Cited by 25 · see citing works

Reusability Issues and Ada

Gargaro, A. (1987) · IEEE Software · doi:10.1109/ms.1987.231063 · Cited by 25 · see citing works

Network intrusion detection using neural networks

Cansian, A. M., Moreira, E. D. S., de Carvalho, A. C. P. L. F., et al. (1997) · Cited by 25 · see citing works

Anomaly detection methods in wired networks: a survey and taxonomy

Tapiador, J., García‐Teodoro, P., & Dı́az-Verdejo, J. E. (2004) · Computer Communications · doi:10.1016/s0140-3664(04)00238-5 · Cited by 24 · see citing works

ADMIT

Sequeira, K., & Zaki, M. J. (2002) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775094.775103 · Cited by 21 · see citing works

Proposals on Assessment Environments for Anomaly-Based Network Intrusion Detection Systems

Bermúdez-Edo, M., Hernández, R. S., Dı́az-Verdejo, J. E., et al. (2006) · Lecture notes in computer science · doi:10.1007/11962977_17 · Cited by 13 · see citing works

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works

Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset

Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.05.041 · Cited by 1,983 · see citing works

A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities

Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works

DÏoT: A Federated Self-learning Anomaly Detection System for IoT

Nguyen, T. D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., & Sadeghi, A.-R. (2019) · 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2019.00080 · Cited by 663 · see citing works

An intrusion detection and prevention system in cloud computing: A systematic review

Patel, A., Taghavi, M., Bakhtiyari, K., & Celestino Júnior, J. (2013) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2012.08.007 · Cited by 425 · see citing works

Network anomaly detection with the restricted Boltzmann machine

Fiore, U., Palmieri, F., Castiglione, A., & De Santis, A. (2013) · Neurocomputing · doi:10.1016/j.neucom.2012.11.050 · Cited by 376 · see citing works

Outlier Detection: Methods, Models, and Classification

Boukerche, A., Zheng, L., & Alfandi, O. (2021) · ACM Computing Surveys · doi:10.1145/3381028 · Cited by 334 · see citing works

Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree

Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works

Reinforcement learning for iot security: A comprehensive survey

Uprety, A., & Rawat, D. B. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3040957 · Cited by 214 · see citing works

From intrusion detection to attacker attribution: A comprehensive survey of unsupervised methods

Nisioti, A., Mylonas, A., Yoo, P. D., & Katos, V. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2854724 · Cited by 212 · see citing works

Intrusion detection using reduced-size RNN based on feature grouping

Sheikhan, M., Jadidi, Z., & Farrokhi, A. (2012) · Neural Computing and Applications · doi:10.1007/s00521-010-0487-0 · Cited by 140 · see citing works

Machine Learning for DDoS Attack Detection in Industry 4.0 CPPSs

Saghezchi, F. B., Mantas, G., Violas, M. A., de Oliveira Duarte, A. M., & Rodriguez, J. (2022) · Electronics · doi:10.3390/electronics11040602 · Cited by 81 · see citing works

The “cyber security via determinism” paradigm for a quantum safe zero trust deterministic internet of things (IoT)

Szymanski, T. H. (2022) · IEEE Access · doi:10.1109/access.2022.3169137 · Cited by 59 · see citing works

Towards Quantum-Enhanced Machine Learning for Network Intrusion Detection

Gouveia, A., & Correia, M. (2020) · 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca51143.2020.9306691 · Cited by 52 · see citing works

Towards Learning-automation IoT Attack Detection through Reinforcement Learning

Gu, T., Abhishek, A., Fu, H., Zhang, H., Basu, D., & Mohapatra, P. (2020) · 2020 IEEE 21st International Symposium on "A World of Wireless, Mobile and Multimedia Networks" (WoWMoM) · doi:10.1109/wowmom49955.2020.00029 · Cited by 50 · see citing works

A novel anomaly detection approach based on ensemble semi-supervised active learning (ADESSA)

Niu, Z., Guo, W., Xue, J., Wang, Y., Kong, Z., & Huang, L. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103190 · Cited by 27 · see citing works

IDS alerts classification using knowledge-based evaluation

Gupta, D., Joshi, P. S., Bhattacharjee, A. K., & Mundada, R. S. (2012) · 2012 Fourth International Conference on Communication Systems and Networks (COMSNETS 2012) · doi:10.1109/comsnets.2012.6151339 · Cited by 20 · see citing works

Explainable Anomaly and Intrusion Detection Intelligence for Platform Information Technology Using Dimensionality Reduction and Ensemble Learning

Morris, B. (2019) · 2019 IEEE AUTOTESTCON · doi:10.1109/autotestcon43700.2019.8961052 · Cited by 5 · see citing works

Explainable anomaly detection in encrypted network traffic using data analytics

Rahman, M. M., Soumik, M. S., Farids, M. S., Abdullah, C. A., Sutrudhar, B., Ali, M., & HOSSAIN, M. S. (2024) · Journal of Computer Science and Technology Studies · doi:10.32996/jcsts.2024.6.1.31 · Cited by 1 · see citing works

Research on Computer Network Intrusion Detection System

Jianguo, Z. (2003) · Jisuanji gongcheng

Analysis on Some Problems Related to the Intrusion Detection System

Qiu-xian, Y. (2006) · Sci-Tech Information Development & Economy

A Kind of Intrusion Detection Model

Da-zu, H. (2003) · Journal of Shaoyang University · Cited by 1 · see citing works

FuGeIDS: Fuzzy Genetic paradigms in Intrusion Detection SystemsPreprint

Borgohain, R. (2012) · arXiv (Cornell University) · doi:10.48550/arxiv.1204.6416 · Cited by 6 · see citing works

Survey of Anomaly Intrusion Detection Research

Xie, F. (2009) · Dianzi Ke-ji Daxue xuebao