Active learning for network intrusion detection

Research output: Contributions to collected editions/worksArticle in conference proceedingsResearchpeer-review


Anomaly detection for network intrusion detection is usually considered an unsupervised task. Prominent techniques, such as one-class support vector machines, learn a hypersphere enclosing network data, mapped to a vector space, such that points outside of the ball are considered anomalous. However, this setup ignores relevant information such as expert and background knowledge. In this paper, we rephrase anomaly detection as an active learning task. We propose an effective active learning strategy to query low-confidence observations and to expand the data basis with minimal labeling effort. Our empirical evaluation on network intrusion detection shows that our approach consistently outperforms existing methods in relevant scenarios.

Original languageEnglish
Title of host publicationAISec '09 : Proceedings of the ACM Conference on Computer and Communications Security
EditorsDirk Balfanz, Jessica Staddon
Number of pages8
Place of PublicationNew York
PublisherAssociation for Computing Machinery, Inc
Publication date2009
ISBN (Print)978-1-60558-781-3
Publication statusPublished - 2009
Event2nd ACM Workshop on Security and Artificial Intelligence, AISec '09, Co-located with the 16th ACM Computer and Communications Security Conference - Chicago, United States
Duration: 09.11.200913.11.2009
Conference number: 2

    Research areas

  • Informatics - Active learning, Anomaly detection, Intrusion detection, Machine learning, Network security, Support vector data description
  • Business informatics