Intrusion detection using principal component analysis

We introduce a novel anomaly intrusion detection method based on Principal Component Analysis. This approach functions by projecting users’ profiles onto a feature space that spans the significant variations among known user profiles. The significant features are known as eigenprofiles because they are the eigenvectors (principal components) of the set of user profiles. The projection operation characterizes a user profile by a weighted sum of the eigenprofile features, so as to detect whether a user profile is anomalous, it is sufficient to compare its weights to those of known user profiles. Some advantages of this new approach are that: (i) it provides for the ability to learn and later determine whether a new profile does or does not correspond to those of known users, (ii) its implementation is very easy in any system having the audit mechanism, and (iii) it is robust and provides high rates of detection in a short time. We first derive some computational feasible formula to find eigenprofiles, and then we describe the intrusion detection algorithm based on these eigenprofiles. Our first experimentations are based on some simulated unix users and then we have used real users’ profiles where each profile describes the number of different web pages visited by the corresponding user. The experimental results using this algorithm are very interesting in both cases, simulated and real behaviors.