Year: 2014
Type: dissertation
Abstract: Increasing network traffic and introduction of more and more complex web services creates new vulnerabilities for attackers. As a result, attacks have become more complex and unpredictable. New and previously unseen intrusions cannot be detected using manual signature-based detection. For this reason, automatic traffic analysis and anomaly intrusion detection systems are needed. Anomaly detection faces many problems, such as high number of false alarms and lack of validation with real data. This thesis focuses on analyzing real-world network log data by using a knowledge discovery process and data mining methods. The framework combines data preprocessing, dimensionality reduction, clustering and anomaly detection. The proposed parts of the system are tested using real data. The framework is capable of producing meaningful results, such as detecting actual intrusion attempts that are present in the data. In addition, representative visualizations of high-dimensional data can be created to provide more information to the network administrator. The framework is also capable of dynamically analyzing and adding more traffic data as it’s being created in the network. The study focuses on practical use and feasibility of the framework, and is backed up by practical experiments presented in the included articles.
Author: Antti Juvonen
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
Funders: Nokia, Nokia Foundation, Jyväskylän Yliopisto
OpenAlex ID: W2231830712