@conference {179,
	title = {An Autonomous labeling approach to SVM algorithms for network traffic anomaly detection},
	booktitle = {Argentine Symposium of Artificial Intelligence (ASAI). Jornadas Argentinas de Inform{\'a}tica. Mar del Plata, Argentina.},
	year = {2009},
	month = {08/2009},
	publisher = {Sociedad Argentina de Inform{\'a}tica},
	organization = {Sociedad Argentina de Inform{\'a}tica},
	address = {Mar del Plata, Argentina},
	abstract = {<p>In the past years, several support vector machines anomaly detection approaches have been proposed in the network intrusion detetion field. The main advantage of these approaches is that they\&nbsp; can\&nbsp; characterize normal traffic\&nbsp; when trained using a data set\&nbsp; containing not only normal traffic\&nbsp; but also possible attacks. Unfortunately, these algorithms seem to be accurate only when the normal traffic\&nbsp; vastly outnumbers the numbers of attacks or anomalies present in the dataset. This work presents an approach for autonomous labeling of normal traffic\&nbsp;\&nbsp; as a way of dealing with situations where\&nbsp; class distributions do not present the required unbalance. The autonomous labeling process is made by SNORT, a misuse-based intrusion detection system. Experiments\&nbsp; conducted on the 1998 DARPA dataset show the proposed autonomous labeling approach not only outperforms existing SVM alternatives but also obtains signicant improvement over SNORT itself.</p>
},
	author = {Brombereg, Facundo and Catania, Carlos A. and Garcia Garino, Carlos}
}
