TY - GEN
T1 - Attribute normalization in network intrusion detection
AU - Wang, Wei
AU - Zhang, Xiangliang
AU - Gombault, Sylvain
AU - Knapskog, Svein J.
N1 - Generated from Scopus record by KAUST IRTS on 2023-09-21
PY - 2009
Y1 - 2009
N2 - Anomaly intrusion detection is an important issue in computer network security. As a step of data preprocessing, attribute normalization is essential to detection performance. However, many anomaly detection methods do not normalize attributes before training and detection. Few methods consider to normalize the attributes but the question of which normalization method is more effective still remains. In this paper, we introduce four different schemes of attribute normalization to preprocess the data for anomaly intrusion detection. Three methods, k-NN, PCA as well as SVM, are then employed on the normalized data for comparison of the detection results. KDD Cup 1999 data are used to evaluate the normalization schemes and the detection methods. The systematical evaluation results show that the process of attribute normalization improves a lot the detection performance. The statistical normalization scheme is the best choice for detection if the data set is large.
AB - Anomaly intrusion detection is an important issue in computer network security. As a step of data preprocessing, attribute normalization is essential to detection performance. However, many anomaly detection methods do not normalize attributes before training and detection. Few methods consider to normalize the attributes but the question of which normalization method is more effective still remains. In this paper, we introduce four different schemes of attribute normalization to preprocess the data for anomaly intrusion detection. Three methods, k-NN, PCA as well as SVM, are then employed on the normalized data for comparison of the detection results. KDD Cup 1999 data are used to evaluate the normalization schemes and the detection methods. The systematical evaluation results show that the process of attribute normalization improves a lot the detection performance. The statistical normalization scheme is the best choice for detection if the data set is large.
UR - http://www.scopus.com/inward/record.url?scp=77949788147&partnerID=8YFLogxK
U2 - 10.1109/I-SPAN.2009.49
DO - 10.1109/I-SPAN.2009.49
M3 - Conference contribution
AN - SCOPUS:77949788147
SN - 9780769539089
T3 - I-SPAN 2009 - The 10th International Symposium on Pervasive Systems, Algorithms, and Networks
SP - 448
EP - 453
BT - I-SPAN 2009 - The 10th International Symposium on Pervasive Systems, Algorithms, and Networks
PB - IEEE Computer Society
T2 - 10th International Symposium on Pervasive Systems, Algorithms, and Networks, I-SPAN 2009
Y2 - 14 December 2009 through 16 December 2009
ER -