• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

Effective Dimensionality Reduction of Payload-Based Anomaly Detection in TMAD Model for HTTP Payload


Abstract

Intrusion Detection System (IDS) in general considers a big amount of data that are highly redundant and irrelevant. This trait causes slow instruction, assessment procedures, high resource consumption and poor detection rate. Due to their expensive computational requirements during both training and detection, IDSs are mostly ineffective for real-time anomaly detection. This paper proposes a dimensionality reduction technique that is able to enhance the performance of IDSs up to constant time O(1) based on the Principle Component Analysis (PCA). Furthermore, the present study offers a feature selection approach for identifying major components in real time. The PCA algorithm transforms high-dimensional feature vectors into a low-dimensional feature space, which is used to determine the optimum volume of factors. The proposed approach was assessed using HTTP packet payload of ISCX 2012 IDS and DARPA 1999 dataset. The experimental outcome demonstrated that our proposed anomaly detection achieved promising results with 97% detection rate with 1.2% false positive rate for ISCX 2012 dataset and 100% detection rate with 0.06% false positive rate for DARPA 1999 dataset. Our proposed anomaly detection also achieved comparable performance in terms of computational complexity when compared to three state-of-the-art anomaly detection systems.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
M. Kakavand, N. Mustapha, A. Mustapha, M. T. Abdullah, "Effective Dimensionality Reduction of Payload-Based Anomaly Detection in TMAD Model for HTTP Payload," KSII Transactions on Internet and Information Systems, vol. 10, no. 8, pp. 3884-3910, 2016. DOI: 10.3837/tiis.2016.08.025.

[ACM Style]
Mohsen Kakavand, Norwati Mustapha, Aida Mustapha, and Mohd Taufik Abdullah. 2016. Effective Dimensionality Reduction of Payload-Based Anomaly Detection in TMAD Model for HTTP Payload. KSII Transactions on Internet and Information Systems, 10, 8, (2016), 3884-3910. DOI: 10.3837/tiis.2016.08.025.

[BibTeX Style]
@article{tiis:21196, title="Effective Dimensionality Reduction of Payload-Based Anomaly Detection in TMAD Model for HTTP Payload", author="Mohsen Kakavand and Norwati Mustapha and Aida Mustapha and Mohd Taufik Abdullah and ", journal="KSII Transactions on Internet and Information Systems", DOI={10.3837/tiis.2016.08.025}, volume={10}, number={8}, year="2016", month={August}, pages={3884-3910}}