A Time-stamp Frequent Pattern-based Clustering Method for Anomaly Detection

Anomaly detection, as an important complement to misuse detection, has the capability of finding and foiling both known and "zero day" attacks. Performing anomaly detection in real time places hard requirement on the algorithms used. It makes many detection techniques based on proposed data mining algorithms less suitable to be used under real-time network circumstances. To address the problem, a novel anomaly detection algorithm using time-stamped clustering is proposed. In this paper, the normality model used for detection is the clustering result of BIRCH. Once a cluster is generated or modified in the tree index of BIRCH, it will be marked by a lasted modified time-stamp and frequent item. Using each cluster′s time-stamp and frequent item, the algorithm can dynamically remove some expired clusters from the model, and can also produce some new clusters that makes our clustering method more suitable for the real network environment. Experiments with the KDDCUP 1999 dataset show that our algorithm is less sensitive to noise data objects than ADWICE and has lower computer resource consumption.