Statistical profiling and visualization for detection of malicious insider attacks on computer networks

VizSEC/DMSEC '04: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security

Volumn , Issue , 2004, Pages 138-142

  Colombe, Jeffrey B ^a   Stephens, Gregory ^a  

^a MITRE CORPORATION   (United States)

Author keywords

Anomaly detection; Cognitive load; Human computer interaction; Information visualization

Indexed keywords

COMPUTER NETWORKS; COMPUTER SOFTWARE; COST EFFECTIVENESS; GRAPHIC METHODS; HEURISTIC METHODS; HUMAN COMPUTER INTERACTION; SECURITY OF DATA; SENSORS; STATISTICAL METHODS; VISUALIZATION;

ANOMALY DETECTION; COGNITIVE LOADS; INFORMATION VISUALIZATION; INTRUSION DETECTION SYSTEMS (IDS);

COMPUTER CRIME;

EID: 20444471202     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1029208.1029231     Document Type: Conference Paper

References (19)

1. Allan A (2003) Intrusion detection systems: Perspective. Gartner Research Report. April 24, 2003.
2. Axelsson S (2000) The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security 3:186-205.
3. Clifton C and Gengo G (2000) Developing custom intrusion detection filters using data mining. In: Military Communications International Symposium (MILCOM2000).
4. Dain O and Cunningham RK (2002) Fusing heterogeneous alert streams into scenarios. In: Applications of Data Mining and Computer Security. Kluwer Academic Publishers, Boston.
5. Erbacher RF and Frincke D (2001) Visual behavior characterization for intrusion and misuse detection. Proceedings of the SPIE 2001 Conference on Visual Data Exploration and Analysis VIII, San Jose, CA, January 2001, pp 210-218.
6. Erbacher RF and Sobylak K (2002) Improving intrusion analysis effectiveness. 2002 Workshop on Computer Forensics, Moscow, ID, September, 2002.
7. Eskin E, Arnold A, Prerau M, Portnoy L and Stolfo L (2002) A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data. In: Applications of Data Mining in Computer Security (Advances in Information Security, 6), Jajodia S and Barbara D, Eds. Kluwer Academic Publishers.
8. Hulme GV (2003) Gartner: Intrusion detection on the way out. Information Week, June 13, 2003.
9. Julisch K (2003) Clustering intrusion detection alarms to support root cause analysis. ACM Transactions on Information and System Security 6.
10. Julisch K and Dacier M (2002) Mining intrusion detection alarms for actionable knowledge. Proceedings of the 8th ACM International Conference on Knowledge Discovery and Data Mining, Edmonton.
11. Lane T (1999) Hidden Markov models for human/computer interface modeling. In: Proceedings of the IJCAI-99 Workshop on Learning about Users, pp 35-44.
12. Manganaris S, Christensen M, Zerkle D and Hermiz K (2000) A data mining analysis of RTID alarms. Computer Networks 34:571-577.
13. Mannila H, Toivonen H and Verkamo AI (1997) Discovery of frequent episodes in event sequences. University of Helsinki Department of Computer Science, Series of Publications C, Report C-1997-15.
14. Mel B W and Fiser J (2000) Minimizing binding errors using learned conjunctive features. Neural Computation 12:247-278.
15. Ning P, Cui Y and Reeves DS (2002) Constructing attack scenarios through correlation of intrusion alerts. 9th ACM Conference on Computer and Communications Security.
16. Ning P and Xu D (2003) Learning attack strategies from intrusion alerts. 10th ACM Conference on Computer and Communications Security.
17. Tufte ER (1983) The Visual Display of Quantitative Information. Graphics Press.
18. Valdes A and Skinner K (2001) Probabilistic alert correlation. 4th Workshop on Recent Advances in Intrusion Detection (RAID). LNCS. Springer Verlag, Berlin, pp 54-68.
19. Vert G, McConnell J and Frincke D (1998) Towards a mathematical model for intrusion. 21st National Information Systems Security Conference, October 1998, pp 329-337.