Unknown Attacks Detection Using Feature Extraction from Anomaly-Based IDS Alerts

Intrusion Detection Systems (IDSs) play an important role detecting various kinds of attacks and defend our computer systems from them. There are basically two main types of detection techniques: signature-based and anomaly-based. A signature-based IDS cannot detect unknown attacks because a signature has not been written. To overcome this shortcoming, many researchers have been developing anomaly-based IDSs. Although they can detect unknown attacks, there is a problem that they just classify network traffic into normal or abnormal. Therefore, IDS operators have to manually inspect IDS alerts to classify them into known attacks or unknown attacks. Because there are a lot of alerts related to known attacks, it is difficult to extract only unknown attacks from them. In this paper, we present a method that automatically detects unknown attacks from an anomaly-based IDS alerts. We evaluate our method using Kyoto2006+ dataset.