Fast Anomaly Detection based on Data Stream in Network Intrusion Detection System

Abstract

Intrusion detection system is a primary defense mechanism in aspect of protecting network security. Anomaly detection, as one of the most commonly used intrusion detection methods, plays a significant part in detecting the network traffic data. However, network traffic data is typical data stream pattern that is in the natures of infiniteness, correlation and concept drift, which bring some challenges to traditional anomaly detection algorithms for static data. In this paper, a novel method (called DLSHiForest*) based on LSHiForest, sliding window, concept drift detection and model update is proposed, which can cope with above issues to improve detection accuracy while guaranteeing anomaly detection efficiency. Extensive experiments are conducted using SMTP dataset to verify the feasibility of our proposed method. Experimental results demonstrate that our proposal can achieve accurate and efficient anomaly detection for data stream.