Efficient masquerade detection using SVM based on common command frequency in sliding windows

IEICE Transactions on Information and Systems

Volumn E87-D, Issue 11, 2004, Pages 2446-2452

  Kim, Han Sung ^a   Cha, Sung Deok ^a  

^a Korea Advanced Institute of Science and Technology (KAIST)   (South Korea)

Author keywords

Anomaly detection; Intrusion detection; Machine learning; Masquerade detection; SVM (Support Vector Machine); User command

Indexed keywords

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; LEARNING SYSTEMS; STATISTICAL METHODS; WORLD WIDE WEB;

ANOMALY DETECTION; INTRUSION DETECTION; MASQUERADE DETECTION; SUPPORT VECTOR MACHINE (SVM); USER COMMAND;

SECURITY OF DATA;

EID: 10444221762     PISSN: 09168532     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (18)

1. J.P. Anderson, "Computer security threat monitoring and surveillance," Technical Report, James P. Anderson Company, Fort Washington, PA, April 1980.
2. W. Webster, C. Alexander, G. Bell, W. Cohen, R. Fiske, T. Foley, and C. Hills, "A review of FBI security programs," March 2002.
3. T.H. Ptacek, "Insertion, evasion, and denial of service: Eluding network intrusion detection," http://secinf.net/info/ids/idspaper/idspaper.html, Oct. 2002.
4. R.F. Puppy, "A look at whisker's anti-IDS tactics," http://www.wiretrip.net/rfp/txt/whiskerids.html, Dec. 1999.
5. CSI and FBI, "Computer security issues and trends: 2002 CSI/FBI computer crime and security survey," Computer Security Inst., 2002.
6. M. Schonlau, W. DuMouchel, W.H. Ju, A.F. Karr, M. Theus, and Y. Vardi, "Computer intrusion: Detecting masquerades," Statistical Science, vol.16, no.1, pp.58-74, Feb. 2001.
7. W. Lee and S. Stolfo, "Data mining approaches for intrusion detection," Proc. 7th USENIX Security Symp., pp.79-94, San Antonio, TX, 1998.
8. T.D. Lane, Machine Learning Techniques for the Computer Security Domain of Anomaly Detection, Ph.D. Thesis, Department of Electrical and Computer Engineering, Purdue University, Aug. 2000.
9. C.J.C. Burges, "A tutorial on support vector machines for pattern recognition," Data Mining and Knowledge Discovery, vol.2, no.2, pp.121-167, 1998.
10. R. Maxion and T. Townsend, "Masquerade detection using truncated command lines," Proc. Int'l Conf. Dependable Systems and Networks (DSN-02), pp.219-228, June 2002.
11. T. Joachims, "Estimating the generalization performance of a SVM efficiently," pp.431-438, 2000.
12. Y. Yang and X. Liu, "A re-examination of text categorization methods," Proc. SIGIR-99, 22nd ACM Int'l Conf. Research and Development in Information Retrieval, pp.42-49, 1999.
13. S.T. Dumais and H. Chen, "Hierarchical classification of Web content," Proc. SIGIR-00, 23rd ACM Int'l Conf. Research and Development in Information Retrieval, pp.256-263, 2000.
14. S. Mukkamala, G. Janowski, and A.H. Sung, "Intrusion detection using support vector machines," Proc. IEEE Int'l Joint Conf. Neural Networks, pp.1702-1707, May 2002.
15. M. Fugate and J.R. Gattier, "Anomaly detection enhanced classification in computer intrusion detection," SVM 2002, LNCS 2388, pp.186-197, May 2002.
16. S. Mukkamala, G. Janowski, and A.H. Sung, "Intrusion detection using support vector machines," Proc. High Performance Computing Symp.-HPC 2002, pp.178-183, April 2002.
17. C.W. Hsu, C.C. Chang, and C.J. Lin, "A practical guide to support vector classification," http://www.csie.ntu.edu.tw/~cjlin/papers/guide/guide.pdf, 2004.
18. C.C. Chang and C.J. Lin, "Libsvm - A library for support vector machines," http://www.csie.ntu.edu.tw/~cjlin/libsvm/