The DOI matches its Crossref record; 19 of the 19 references it cites were found in a registry or an index.
Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection
Abstract
Anomaly detection is a critical issue in Network Intrusion Detection Systems (NIDSs). Most anomaly based NIDSs employ supervised algorithms, whose performances highly depend on attack-free training data. However, this kind of training data is difficult to obtain in real world network environment. Moreover, with changing network environment or services, patterns of normal traffic will be changed. This leads to high false positive rate of supervised NIDSs. Unsupervised outlier detection can overcome the drawbacks of supervised anomaly detection. Therefore, we apply one of the efficient data mining algorithms called random forests algorithm in anomaly based NIDSs. Without attack-free training data, random forests algorithm can detect outliers in datasets of network traffic. In this paper, we discuss our framework of anomaly based network intrusion detection. In the framework, patterns of network services are built by random forests algorithm over traffic data. Intrusions are detected by determining outliers related to the built patterns. We present the modification on the outlier detection algorithm of random forests. We also report our experimental results over the KDD'99 dataset. The results show that the proposed approach is comparable to previously reported unsupervised anomaly detection approaches evaluated over the KDD' 99 dataset.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Witten, I. H. (2008) · Cited by 9,143
Probability Estimates for Multi-class Classification by Pairwise Coupling
Wu, T., Lin, C., & Weng, R. C. (2004) · Journal of Machine Learning Research · doi:10.5555/1005332.1016791 · Cited by 1,468
Probability Estimates for Multi-class Classification by Pairwise Coupling
Wu, T., Lin, C., Weng, R. C., & Singer, Y. (2003) · Cited by 989
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection
Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., & Srivastava, J. (2003) · Proceedings of the 2003 SIAM International Conference on Data Mining · doi:10.1137/1.9781611972733.3 · Cited by 865
A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data
Eskin, E., Arnold, A., Prerau, M., Portnoy, L., & Stolfo, S. (2002) · Advances in Information Security · doi:10.1007/978-1-4615-0953-0_4 · Cited by 683
A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data
Eskin, E., Arnold, A. O., Prerau, M. J., Portnoy, L., & Stolfo, S. J. (2002) · doi:10.7916/d8d50tqt · Cited by 603
An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection
Mahoney, M. V., & Chan, P. K. (2003) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-45248-5_13 · Cited by 535
Unsupervised anomaly detection in network intrusion detection using clusters
Leung, K., & Leckie, C. A. (2005) · Cited by 349
Results of the KDD'99 classifier learning
Elkan, C. (2000) · ACM SIGKDD Explorations Newsletter · doi:10.1145/846183.846199 · Cited by 292
Cited by
Moustafa, N., & Slay, J. (2015) · 2015 Military Communications and Information Systems Conference (MilCIS) · doi:10.1109/milcis.2015.7348942 · Cited by 4,033
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036
Machine Learning for Anomaly Detection: A Systematic Review
Nassif, A. B., Talib, M. A., Nasir, Q., & Dakalbab, F. M. (2021) · IEEE Access · doi:10.1109/access.2021.3083060 · Cited by 748
Detection of Outliers Using Interquartile Range Technique from Intrusion Dataset
Vinutha, H. P., Poornima, B., & Sagar, B. M. (2018) · Advances in Intelligent Systems and Computing · doi:10.1007/978-981-10-7563-6_53 · Cited by 386
A hybrid intrusion detection system design for computer network security
Aydın, M. A., Zaim, A. H., & Ceylan, K. G. (2009) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2008.12.005 · Cited by 288
Metadata
- Authors
- Zhang, J., & Zulkernine, M.
- Venue
- 2006 IEEE International Conference on Communications
- Publisher
- IEEE
- Published
- 2006
- Pages
- 2388-2393
- ISSN
- 1550-3607 (ISSN-L)
- OpenAlex
- W2153919695
- Cited by
- 256
- References
- 19
- FWCI
- 4.43
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection. https://app.cochat.ai/papers/10.1109/icc.2006.255127
- The paper
- Zhang, J., & Zulkernine, M. (2006). Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection. 2006 IEEE International Conference on Communications. https://doi.org/10.1109/icc.2006.255127
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
