Machine Learning Techniques for Anomaly Detection: An Overview
---
paper_title: Intrusion Detection Techniques

paper_content:

In an information system,intrusions are the activities that violate the security policy of the system, and intrusion detection is the process used to identify intrusions. Intrusion detection techniques have been traditionally classified into one of two methodologies: anomaly detection or misuse detection. This chapter gives an overview of the existing intrusion detection techniques, including anomaly detection and misuse detection models, and identifies techniques related to intrusion detection in distributed systems. Topics covered include statistical models, machine learning and data mining approaches, computer immunological approach, specification-based approach, information theoretic measures for anomaly detection, rule-based languages, state transition analysis toolkit, colored Petri automata (CPA), abstraction-based approach, distributed intrusion detection systems, network-based intrusion detection systems, and information sharing among intrusion detection systems. ::: ::: ::: Keywords: ::: ::: anomaly detection; ::: audit trail; ::: intrusion detection; ::: intrusions; ::: misuse detection; ::: misuse signature
---
paper_title: Anomaly detection methods in wired networks: a survey and taxonomy

paper_content:

Despite the advances reached along the last 20 years, anomaly detection in network behavior is still an immature technology, and the shortage of commercial tools thus corroborates it. Nevertheless, the benefits which could be obtained from a better understanding of the problem itself as well as the improvement of these mechanisms, especially in network security, justify the demand for more research efforts in this direction. This article presents a survey on current anomaly detection methods for network intrusion detection in classical wired environments. After introducing the problem and elucidating its interest, a taxonomy of current solutions is presented. The outlined scheme allows us to systematically classify current detection methods as well as to study the different facets of the problem. The more relevant paradigms are subsequently discussed and illustrated through several case studies of selected systems developed in the field. The problems addressed by each of them as well as their weakest points are thus explained. Finally, this work concludes with an analysis of the problems that still remain open. Based on this discussion, some research lines are identified.
---
paper_title: Internet traffic classification using bayesian analysis techniques

paper_content:

Accurate traffic classification is of fundamental importance to numerous other network activities, from security monitoring to accounting, and from Quality of Service to providing operators with useful forecasts for long-term provisioning. We apply a Naive Bayes estimator to categorize traffic by application. Uniquely, our work capitalizes on hand-classified network data, using it as input to a supervised Naive Bayes estimator. In this paper we illustrate the high level of accuracy achievable with the \Naive Bayes estimator. We further illustrate the improved accuracy of refined variants of this estimator.Our results indicate that with the simplest of Naive Bayes estimator we are able to achieve about 65% accuracy on per-flow classification and with two powerful refinements we can improve this value to better than 95%; this is a vast improvement over traditional techniques that achieve 50--70%. While our technique uses training data, with categories derived from packet-content, all of our training and testing was done using header-derived discriminators. We emphasize this as a powerful aspect of our approach: using samples of well-known traffic to allow the categorization of traffic using commonly available information alone.
---
paper_title: Anomaly Intrusion Detection Approach Using Hybrid MLP/CNN Neural Network

paper_content:

An anomaly intrusion detection approach based on Hybrid MLP/CNN (Multi-layer Perceptron / Chaotic Neural Network) neural network is proposed in this paper. Most anomaly detection approaches using MLP can detecting novel real-time attacks, but still have high false alarm rates. Most attacks are composed of a series of anomaly events. These attacks are called timedelayed attacks, which current neural network IDSs (Intrusion Detection System) cannot identify efficiently. A hybrid MLP/CNN neural network is constructed in order to improve the detection rate of time-delayed attacks. While obtaining a similarly detection rate of real-time attacks as the MLP does, the proposed approach can detect time-delayed attacks efficiently with chaotic neuron. This approach also exhibits a lower false alarm rate when detects novel attacks. The simulation tests are conducted using DARPA 1998 dataset. The experimental results are presented and compared in ROC curves, which can demonstrate that the proposed approach performs exceptionally in terms of both detection rate and false alarm rate.
---
paper_title: The use of artificial intelligence based techniques for intrusion detection: a review

paper_content:

The Internet connects hundreds of millions of computers across the world running on multiple hardware and software platforms providing communication and commercial services. However, this interconnectivity among computers also enables malicious users to misuse resources and mount Internet attacks. The continuously growing Internet attacks pose severe challenges to develop a flexible, adaptive security oriented methods. Intrusion detection system (IDS) is one of most important component being used to detect the Internet attacks. In literature, different techniques from various disciplines have been utilized to develop efficient IDS. Artificial intelligence (AI) based techniques plays prominent role in development of IDS and has many benefits over other techniques. However, there is no comprehensive review of AI based techniques to examine and understand the current status of these techniques to solve the intrusion detection problems. In this paper, various AI based techniques have been reviewed focusing on development of IDS. Related studies have been compared by their source of audit data, processing criteria, technique used, dataset, classifier design, feature reduction technique employed and other experimental environment setup. Benefits and limitations of AI based techniques have been discussed. The paper will help the better understanding of different directions in which research has been done in the field of IDS. The findings of this paper provide useful insights into literature and are beneficial for those who are interested in applications of AI based techniques to IDS and related fields. The review also provides the future directions of the research in this area.
---
paper_title: RBF-based real-time hierarchical intrusion detection systems

paper_content:

An intrusion detection system (IDS) is an art to detect network intrusions by monitoring the network traffic patterns. Generally, an IDS uses only a single-layer detection structure; therefore it cannot adjust its structure adaptively and automatically. In this paper, two hierarchical IDSs, the serial hierarchical and parallel hierarchical IDSs, are proposed. Both of them are based on radial basis function (RBF) neural networks. Because of the short training time and high accuracy of the RBF neural networks, two hierarchical IDSs can monitor network traffic in real-time, train new classifiers for novel intrusions automatically, and modify their structures adaptively after new classifiers are trained.
---
paper_title: A Comparison Of Input Representations In Neural Networks: A Case Study In Intrusion Detection

paper_content:

Recently intrusion detection techniques have shifted from user-based and connection-based to process-based approach. Forrest et al. (1996) presented one or the first papers analyzing sequences of system calls issued by a process for intrusion detection. Warrender et al. (1999) do a comparison of the accuracy and performance of different algorithms for the analysis of sequential calls. In this paper we present a comparison of two different encoding methods for three types of neural networks. We apply these classifiers to implement an anomaly detection module for UNIX processes.
---
paper_title: Effective Value of Decision Tree with KDD 99 Intrusion Detection Datasets for Intrusion Detection System

paper_content:

A decision tree is a outstanding method for the data mining. In intrusion detection systems (IDSs), the data mining techniques are useful to detect the attack especially in anomaly detection. For the decision tree, we use the DARPA 98 Lincoln Laboratory Evaluation Data Set (DARPA Set) as the training data set and the testing data set. KDD 99 Intrusion Detection data set is also based on the DARPA Set. These three entities are widely used in IDSs. Hence, we describe the total process to generate the decision tree learned from the DARPA Sets. In this paper, we also evaluate the effective value of the decision tree as the data mining method for the IDSs, and the DARPA Set as the learning data set for the decision trees.
---
paper_title: C4.5: Programs for Machine Learning

paper_content:

From the Publisher: ::: Classifier systems play a major role in machine learning and knowledge-based systems, and Ross Quinlan's work on ID3 and C4.5 is widely acknowledged to have made some of the most significant contributions to their development. This book is a complete guide to the C4.5 system as implemented in C for the UNIX environment. It contains a comprehensive guide to the system's use , the source code (about 8,800 lines), and implementation notes. The source code and sample datasets are also available on a 3.5-inch floppy diskette for a Sun workstation. ::: ::: C4.5 starts with large sets of cases belonging to known classes. The cases, described by any mixture of nominal and numeric properties, are scrutinized for patterns that allow the classes to be reliably discriminated. These patterns are then expressed as models, in the form of decision trees or sets of if-then rules, that can be used to classify new cases, with emphasis on making the models understandable as well as accurate. The system has been applied successfully to tasks involving tens of thousands of cases described by hundreds of properties. The book starts from simple core learning methods and shows how they can be elaborated and extended to deal with typical problems such as missing data and over hitting. Advantages and disadvantages of the C4.5 approach are discussed and illustrated with several case studies. ::: ::: This book and software should be of interest to developers of classification-based intelligent systems and to students in machine learning and expert systems courses.
---
paper_title: Model Selection for Kernel Based Intrusion Detection Systems

paper_content:

This paper describes results concerning the robustness and generalization capabilities of a supervised machine learning method in detecting intrusions using network audit trails. We also evaluate the impact of kernel type and parameter values on the accuracy with which a support vector machine (SVM) performs intrusion classification. We show that classification accuracy varies with the kernel type and the parameter values; thus, with appropriately chosen parameter values, intrusions can be detected by SVMs with higher accuracy and lower rates of false alarms.
---
paper_title: Statistical learning theory

paper_content:

A comprehensive look at learning and generalization theory. The statistical theory of learning and generalization concerns the problem of choosing desired functions on the basis of empirical data. Highly applicable to a variety of computer science and robotics fields, this book offers lucid coverage of the theory as a whole. Presenting a method for determining the necessary and sufficient conditions for consistency of learning process, the author covers function estimates from small data pools, applying these estimations to real-life problems, and much more.
---
paper_title: Octopus-IIDS: An anomaly based intelligent intrusion detection system

paper_content:

The intrusion detection systems (IDS) are designed to identify unwanted attempts at manipulating, accessing or disabling of computer systems, mainly through a network, such as the Internet. Additionally, the IDSs can perform other functions like intrusion prevention (IPS), including proactive functions. A recurrent problem in intrusion detection systems is the difficulty to distinguish legitimate access from attacks. A lot of conventional IDSs are signature based, although they do not identify variations of these attacks nor new attacks. This paper presents an intrusion detection system model based on the behavior of network traffic through the analysis and classification of messages. Two artificial intelligence techniques named Kohonen neural network (KNN) and support vector machine (SVM) are applied to detect anomalies. These techniques are used in sequence to improve the system accuracy, identifying known attacks and new attacks, in real time. The paper also makes an analysis of the features used to classify data in order to define which of them are really relevant for each class of attack defined in our experiments.
---
paper_title: A Mixed Unsupervised Clustering-Based Intrusion Detection Model

paper_content:

Through analyzing the advantages and disadvantages between anomaly detection and misuse detection, a mixed intrusion detection system (IDS) model is designed. First, data is examined by the misuse detection module, then abnormal data detection is examined by anomaly detection module. In this model, the anomaly detection module is built using unsupervised clustering method, and the algorithm is an improved algorithm of K-means clustering algorithm and it is proved to have high detection rate in the anomaly detection module.
---
paper_title: Real-Time Intrusion Detection System Based on Self-Organized Maps and Feature Correlations

paper_content:

Detecting network intrusion has been not only critical but also difficult in the network security research area. Traditional supervised learning techniques are not appropriate to detect anomalous behaviors and new attacks because of temporal changes in network intrusion patterns and characteristics. Therefore, unsupervised learning techniques such as SOM (self-organizing map) are more appropriate for anomaly detection. In this paper, we proposed a real-time intrusion detection system based on SOM that groups similar data and visualize their clusters. Our system labels the map produced by SOM using correlations between features. We experiments our system with KDD Cup 1999 data set. Our system yields the reasonable misclassification rates and takes 0.5 seconds to decide whether a behavior is normal or attack.
---
paper_title: On the capability of an SOM based intrusion detection system

paper_content:

An approach to network intrusion detection is investigated, based purely on a hierarchy of Self-Organizing Feature Maps. Our principle interest is to establish just how far such an approach can be taken in practice. To do so, the KDD benchmark dataset from the International Knowledge Discovery and Data Mining Tools Competition is employed. This supplies a connection-based description of a factitious computer network in which each connection is described in terms of 41 features. Unlike previous approaches, only 6 of the most basic features are employed. The resulting system is capable of detection (false positive) rates of 89% (4.6%), where this is at least as good as the alternative data-mining approaches that require all 41 features.
---
paper_title: Adaptive anomaly detection with evolving connectionist systems

paper_content:

Anomaly detection holds great potential for detecting previously unknown attacks. In order to be effective in a practical environment, anomaly detection systems have to be capable of online learning and handling concept drift. In this paper, a new adaptive anomaly detection framework, based on the use of unsupervised evolving connectionist systems, is proposed to address these issues. It is designed to adapt to normal behavior changes while still recognizing anomalies. The evolving connectionist systems learn a subject's behavior in an online, adaptive fashion through efficient local element tuning. Experiments with the KDD Cup 1999 network data and the Windows NT user profiling data show that our adaptive anomaly detection systems, based on Fuzzy Adaptive Resonance Theory (ART) and Evolving Fuzzy Neural Networks (EFuNN), can significantly reduce the false alarm rate while the attack detection rate remains high.
---
paper_title: A Mixed Unsupervised Clustering-Based Intrusion Detection Model

paper_content:

Through analyzing the advantages and disadvantages between anomaly detection and misuse detection, a mixed intrusion detection system (IDS) model is designed. First, data is examined by the misuse detection module, then abnormal data detection is examined by anomaly detection module. In this model, the anomaly detection module is built using unsupervised clustering method, and the algorithm is an improved algorithm of K-means clustering algorithm and it is proved to have high detection rate in the anomaly detection module.
---
paper_title: An Intrusion-Detection Model Based on Fuzzy Class-Association-Rule Mining Using Genetic Network Programming

paper_content:

As the Internet services spread all over the world, many kinds and a large number of security threats are increasing. Therefore, intrusion detection systems, which can effectively detect intrusion accesses, have attracted attention. This paper describes a novel fuzzy class-association-rule mining method based on genetic network programming (GNP) for detecting network intrusions. GNP is an evolutionary optimization technique, which uses directed graph structures instead of strings in genetic algorithm or trees in genetic programming, which leads to enhancing the representation ability with compact programs derived from the reusability of nodes in a graph structure. By combining fuzzy set theory with GNP, the proposed method can deal with the mixed database that contains both discrete and continuous attributes and also extract many important class-association rules that contribute to enhancing detection ability. Therefore, the proposed method can be flexibly applied to both misuse and anomaly detection in network-intrusion-detection problems. Experimental results with KDD99Cup and DARPA98 databases from MIT Lincoln Laboratory show that the proposed method provides competitively high detection rates compared with other machine-learning techniques and GNP with crisp data mining.
---
paper_title: Intrusion Detection Model Based on Hierarchical Fuzzy Inference System

paper_content:

With the growing rate of network attacks, intelligent methods for detecting new attacks have attracted increasing interest. This paper presents an approach incorporating several soft computing techniques to construct a Hierarchical Neuro-Fuzzy Inference intrusion detection system which can implement either misuse or anomaly detection. In the proposed system principal component analysis neural network is used to reduce the dimensions of the feature space. And the preprocessed data is clustered by applying an enhanced Fuzzy C-Means clustering algorithm to extract and manage fuzzy rules. The system developments two level Neuro-Fuzzy inference system. Genetic algorithm is used to optimize the structure of the system. Finally a publicly available DRAPA/KDD99 dataset is used to demonstrate the approaches and the results show their accuracy.
---
paper_title: A fuzzy relative of the isodata process and its use in detecting compact well-separated clusters

paper_content:

Abstract Two fuzzy versions of the k-means optimal, least squared error partitioning problem are formulated for finite subsets X of a general inner product space. In both cases, the extremizing solutions are shown to be fixed points of a certain operator T on the class of fuzzy, k-partitions of X, and simple iteration of T provides an algorithm which has the descent property relative to the least squared error criterion function. In the first case, the range of T consists largely of ordinary (i.e. non-fuzzy) partitions of X and the associated iteration scheme is essentially the well known ISODATA process of Ball and Hall. However, in the second case, the range of T consists mainly of fuzzy partitions and the associated algorithm is new; when X consists of k compact well separated (CWS) clusters, Xi , this algorithm generates a limiting partition with membership functions which closely approximate the characteristic functions of the clusters Xi . However, when X is not the union of k CWS clusters, the limi...
---
paper_title: Fuzzy clustering for intrusion detection

paper_content:

The newly formed Department of Homeland Security has been mandated to reduce America's vulnerability to terrorism. In addition to being charged with physical protection, this newly formed department is also responsible for protecting the nation's critical infrastructure. Protecting computer systems from intrusions is an important aspect of securing the nation's infrastructure. We are exploring how fuzzy data mining and concepts introduced by the semantic Web can operate in synergy to perform distributed intrusion detection. The underlying premise of our intrusion detection model is to describe attacks as instances of an ontology using a semantically rich language, reason over them and subsequently classify them as instances of an attack of a specific type. However, before an abnormality can be specified as an instance of the ontology, it first needs to be detected. Hence, our intrusion detection model is two phased, where the first phase uses data mining techniques to analyze low level data streams that capture process, system and network states and to detect anomalous behavior. The second phase reasons over instances of anomalous behavior specified according to our ontology. This paper focuses on the initial phase of our model: outlier detection within low level data streams. Accordingly, we present the preliminary results of the use of fuzzy clustering to detect anomalies within low level kernel data streams.
---
paper_title: Anomaly detection based on unsupervised niche clustering with application to network intrusion detection

paper_content:

We present a new approach to anomaly detection based on unsupervised niche clustering (UNC). The UNC is a genetic niching technique for clustering that can handle noise, and is able to determine the number of clusters automatically. The UNC uses the normal samples for generating a profile of the normal space (clusters). Each cluster can later be characterized by a fuzzy membership function that follows a Gaussian shape defined by the evolved cluster centers and radii. The set of memberships are aggregated using a max-or fuzzy operator in order to determine the normalcy level of a data sample. Experiments on synthetic and real data sets, including a network intrusion detection data set, are performed and some results are analyzed and reported.
---
paper_title: Unsupervised Niche Clustering: Discovering an Unknown Number of Clusters in Noisy Data Sets

paper_content:

As a valuable unsupervised learning tool, clustering is crucial to many applications in pattern recognition, machine learning, and data mining. Evolutionary techniques have been used with success as global searchers in difficult problems, particularly in the optimization of non-differentiable functions. Hence, they can improve clustering. However, existing evolutionary clustering techniques suffer from one or more of the following shortcomings: (i) they are not robust in the presence of noise, (ii) they assume a known number of clusters, and (iii) the size of the search space explodes exponentially with the number of clusters, or with the number of data points. We present a robust clustering algorithm, called the Unsupervised Niche Clustering algorithm (UNC), that overcomes all the above difficulties. UNC can successfully find dense areas (clusters) in feature space and determines the number of clusters automatically. The clustering problem is converted to a multimodal function optimization problem within the context of Genetic Niching. Robust cluster scale estimates are dynamically estimated using a hybrid learning scheme coupled with the genetic optimization of the cluster centers, to adapt to clusters of different sizes and noise contamination rates. Genetic optimization enables our approach to handle data with both numeric and qualitative attributes, and general subjective, non metric, even non-differentiable dissimilarity measures.
---
paper_title: Maximum likelihood from incomplete data via the EM algorithm

paper_content:

Vibratory power unit for vibrating conveyers and screens comprising an asynchronous polyphase motor, at least one pair of associated unbalanced masses disposed on the shaft of said motor, with the first mass of a pair of said unbalanced masses being rigidly fastened to said shaft and with said second mass of said pair being movably arranged relative to said first mass, means for controlling and regulating the conveying rate during conveyer operation by varying the rotational speed of said motor between predetermined minimum and maximum values, said second mass being movably outwardly by centrifugal force against the pressure of spring means, said spring means being prestressed in such a manner that said second mass is, at rotational motor speeds lower than said minimum speed, held in its initial position, and at motor speeds between said lower and upper values in positions which are radially offset with respect to the axis of said motor to an extent depending on the value of said rotational motor speed.
---
paper_title: Statistical analysis of network traffic for adaptive faults detection

paper_content:

This paper addresses the problem of normal operation baselining for automatic detection of network anomalies. A model of network traffic is presented in which studied variables are viewed as sampled from a finite mixture model. Based on the stochastic approximation of the maximum likelihood function, we propose baselining network normal operation, using the asymptotic distribution of the difference between successive estimates of model parameters. The baseline random variable is shown to be stationary, with mean zero under normal operation. Anomalous events are shown to induce an abrupt jump in the mean. Detection is formulated as an online change point problem, where the task is to process the baseline random variable realizations, sequentially, and raise alarms as soon as anomalies occur. An analytical expression of false alarm rate allows us to choose the design threshold, automatically. Extensive experimental results on a real network showed that our monitoring agent is able to detect unusual changes in the characteristics of network traffic, adapt to diurnal traffic patterns, while maintaining a low alarm rate. Despite large fluctuations in network traffic, this work proves that tailoring traffic modeling to specific goals can be efficiently achieved.
---
paper_title: Network Anomaly Detection with Incomplete Audit Data

paper_content:

With the ever increasing deployment and usage of gigabit networks, traditional network anomaly detection based Intrusion Detection Systems (IDS) have not scaled accordingly. Most, if not all IDS assume the availability of complete and clean audit data. We contend that this assumption is not valid. Factors like noise, mobility of the nodes and the large amount of network traffic make it difficult to build a traffic profile of the network that is complete and immaculate for the purpose of anomaly detection. In this paper, we attempt to address these issues by presenting an anomaly detection scheme, called SCAN (Stochastic Clustering Algorithm for Network Anomaly Detection), that has the capability to detect intrusions with high accuracy even with incomplete audit data. To address the threats posed by network-based denial-of-service attacks in high speed networks, SCAN consists of two modules: an anomaly detection module that is at the core of the design and an adaptive packet sampling scheme that intelligently samples packets to aid the anomaly detection module. The noteworthy features of SCAN include: (a) it intelligently samples the incoming network traffic to decrease the amount of audit data being sampled while retaining the intrinsic characteristics of the network traffic itself; (b) it computes the missing elements of the sampled audit data by utilizing an improved expectation-maximization (EM) algorithm-based clustering algorithm; and (c) it improves the speed of convergence of the clustering process by employing Bloom filters and data summaries.
---
paper_title: One-Class Support Vector Machines with a Conformal Kernel. A Case Study in Handling Class Imbalance

paper_content:

Class imbalance is a widespread problem in many classification tasks such as medical diagnosis and text categorization. To overcome this problem, we investigate one-class SVMs which can be trained to differentiate two classes on the basis of examples from a single class. We propose an improvement of one-class SVMs via a conformal kernel transformation as described in the context of binary SVM classifiers by [2,3]. We tested this improved one-class SVM on a health care problem that involves discriminating 11% nosocomially infected patients from 89% non infected patients. The results obtained are encouraging: compared with three other SVM-based approaches to coping with class imbalance, one-class SVMs achieved the highest sensitivity recorded so far on the nosocomial infection dataset. However, the price to pay is a concomitant decrease specificity, and it is for domain experts to decide the proportion of false positive cases they are willing to accept in order to ensure treatment of all infected patients.
---
paper_title: Network Anomaly Detection Using One Class Support Vector Machine

paper_content:

Anomaly detection is automatic identification of the abnormal behaviors embedded in a large amount of normal data. This paper presents a method based on one class support vector machine (OCSVM) for detecting network anomalies. The telecommunication network performance data are used for the investigation. Firstly, the raw data are preprocessed in order to produce the vector sets required by the OCSVM algorithm. After preprocessing, the vector set of the training data is used to train the OCSVM detector, which is capable of learning the nominal behaviors of the data. The trained detector is then applied on the test data to detect the anomalies. The detected anomalies are finally categorized into major or minor level by comparing with a threshold. In this paper, experiments on three different types of performance data are presented and the results demonstrate the promising performance of the algorithm.
---
paper_title: A hybrid machine learning approach to network anomaly detection

paper_content:

Zero-day cyber attacks such as worms and spy-ware are becoming increasingly widespread and dangerous. The existing signature-based intrusion detection mechanisms are often not sufficient in detecting these types of attacks. As a result, anomaly intrusion detection methods have been developed to cope with such attacks. Among the variety of anomaly detection approaches, the Support Vector Machine (SVM) is known to be one of the best machine learning algorithms to classify abnormal behaviors. The soft-margin SVM is one of the well-known basic SVM methods using supervised learning. However, it is not appropriate to use the soft-margin SVM method for detecting novel attacks in Internet traffic since it requires pre-acquired learning information for supervised learning procedure. Such pre-acquired learning information is divided into normal and attack traffic with labels separately. Furthermore, we apply the one-class SVM approach using unsupervised learning for detecting anomalies. This means one-class SVM does not require the labeled information. However, there is downside to using one-class SVM: it is difficult to use the one-class SVM in the real world, due to its high false positive rate. In this paper, we propose a new SVM approach, named Enhanced SVM, which combines these two methods in order to provide unsupervised learning and low false alarm capability, similar to that of a supervised SVM approach. We use the following additional techniques to improve the performance of the proposed approach (referred to as Anomaly Detector using Enhanced SVM): First, we create a profile of normal packets using Self-Organized Feature Map (SOFM), for SVM learning without pre-existing knowledge. Second, we use a packet filtering scheme based on Passive TCP/IP Fingerprinting (PTF), in order to reject incomplete network traffic that either violates the TCP/IP standard or generation policy inside of well-known platforms. Third, a feature selection technique using a Genetic Algorithm (GA) is used for extracting optimized information from raw internet packets. Fourth, we use the flow of packets based on temporal relationships during data preprocessing, for considering the temporal relationships among the inputs used in SVM learning. Lastly, we demonstrate the effectiveness of the Enhanced SVM approach using the above-mentioned techniques, such as SOFM, PTF, and GA on MIT Lincoln Lab datasets, and a live dataset captured from a real network. The experimental results are verified by m-fold cross validation, and the proposed approach is compared with real world Network Intrusion Detection Systems (NIDS).
---

Title: Machine Learning Techniques for Anomaly Detection: An Overview

Section 1: INTRODUCTION
Description 1: Discuss the background and importance of anomaly detection in intrusion detection systems. Highlight the role of IDSs and the differences between signature detection and anomaly detection systems.

Section 2: ANOMALY DETECTION TECHNIQUES
Description 2: Present a general architecture of anomaly-based network intrusion detection systems (A-NIDS) and the stages involved. Explain the role of machine learning in building these systems.

Section 3: Supervised Anomaly Detection
Description 3: Introduce supervised methods for anomaly detection and explain their advantages and technical challenges. Include sub-sections on specific techniques like Neural Networks (NN), Decision Trees (DT), and Support Vector Machines (SVM).

Section 4: Supervised Neural Network (NN)
Description 4: Detail how neural networks are applied in supervised anomaly detection, including Multilayer Perceptron (MLP) and Radial Basis Function Neural Networks (RBF).

Section 5: Decision Tree (DT)
Description 5: Describe decision tree methods and their application in anomaly detection, including examples of hybrid models and ensemble approaches.

Section 6: Support Vector Machine (SVM)
Description 6: Explain the use of Support Vector Machines in supervised anomaly detection, including specific models and hybrid approaches.

Section 7: Unsupervised Anomaly Detection Techniques
Description 7: Introduce unsupervised methods for anomaly detection, highlighting their assumptions and common algorithms such as K-Means, Self-organizing maps (SOM), Adaptive resonance theory (ART), and One-Class Support Vector Machine (OCSVM).

Section 8: Clustering Techniques
Description 8: Discuss the use of clustering techniques in anomaly detection and their various approaches, including examples of different methods applied to intrusion detection.

Section 9: Unsupervised Neural Network
Description 9: Detail the application of unsupervised neural networks like self-organizing maps (SOM) and adaptive resonance theory (ART) in anomaly detection.

Section 10: Fuzzy C-Means (FCM)
Description 10: Describe the Fuzzy C-means clustering method and its application in anomaly detection, including examples of integrated approaches with other techniques.

Section 11: Unsupervised Niche Clustering (UNC)
Description 11: Explain the Unsupervised Niche Clustering algorithm and its advantages, including an example of its application in intrusion detection.

Section 12: Expectation-Maximization Meta Algorithm (EM)
Description 12: Discuss the Expectation-Maximization Meta algorithm and its application in anomaly detection, including examples of techniques for improving detection speed and accuracy.

Section 13: One-Class Support Vector Machine (OCSVM)
Description 13: Detail the one-class SVM approach for anomaly detection and provide examples of its successful application and modifications for better performance.

Section 14: Anomaly Detection Algorithms Comparison
Description 14: Compare the various unsupervised anomaly detection algorithms in terms of their performance, clustering capabilities, and classification accuracy.

Section 15: CONCLUSION
Description 15: Summarize the key points discussed in the paper, emphasizing the strengths and weaknesses of supervised and unsupervised techniques. Highlight the best-performing methods and the potential for improving anomaly detection systems using machine learning.