A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Datasets Used <s> Intrusion detection systems monitor system activities to identify unauthorized use, misuse, or abuse. IDSs offer a defense when your system's vulnerabilities are exploited and do so without requiring you to replace expensive equipment. The steady growth in research on intrusion detection systems has created a demand for tools and methods to test their effectiveness. The authors have developed a software platform that both simulates intrusions and supports their systematic methodology for IDS testing. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Datasets Used <s> In 1998 and again in 1999, the Lincoln Laboratory of MIT conducted a comparative evaluation of intrusion detection systems (IDSs) developed under DARPA funding. While this evaluation represents a significant and monumental undertaking, there are a number of issues associated with its design and execution that remain unsettled. Some methodologies used in the evaluation are questionable and may have biased its results. One problem is that the evaluators have published relatively little concerning some of the more critical aspects of their work, such as validation of their test data. The appropriateness of the evaluation techniques used needs further investigation. The purpose of this article is to attempt to identify the shortcomings of the Lincoln Lab effort in the hope that future efforts of this kind will be placed on a sounder footing. Some of the problems that the article points out might well be resolved if the evaluators were to publish a detailed description of their procedures and the rationale that led to their adoption, but other problems would clearly remain./par> <s> BIB002
Network intrusion detection is a problem of handling of high dimensional mixed type data. Most approaches considered here are able to handle categorical, numerical or mixed type high dimensional data. Most techniques are evaluated based on KDD Cup 1999 intrusion detection dataset. However, this dataset has several limitations such as (i) the dataset is not unbiased and (ii) it is a purified dataset that does not contain fragment data. Several acedemic and research laboratories, commercial organizations have generated unbiased intrusion datasets to evaluate IDSs and associated datasets. Prototype IDS testing platforms have been developed by University of California at Davis BIB001 and IBM Zurich  . A rigorous and extensive IDS testing was performed by MIT Lincoln Laboratory BIB002 . The Air Force Research Laboratory  has also been involved in IDS testing in a complex hierarchical network environment. The MITRE Corporation  investigated the characteristics and capabilities of network base IDS.