Anomaly detection in computer security and an application to file system accesses

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3488 LNAI, Issue , 2005, Pages 14-28

  Stolfo, Salvatore J ^a   Hershkop, Shlomo ^a   Bui, Linh H ^a   Ferster, Ryan ^a   Wang, Ke ^a  

^a Columbia University ^*  (United States)

Author keywords

Anomaly Detection; File System; Host Based Intrusion Detection; Wrapping

Indexed keywords

FILE ORGANIZATION; LEARNING SYSTEMS; MATHEMATICAL MODELS; PROBABILITY; REAL TIME SYSTEMS;

ANOMALY DETECTION; FILE SYSTEM; HOST-BASED INTRUSION DETECTION; PROBABILISTIC ANOMALY DETECTION (PAD);

SECURITY OF DATA;

EID: 26944448557     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/11425274_2     Document Type: Conference Paper

References (25)

1. F. Apap, A. Honig, S. Hershkop, E. Eskin and S. Stolfo. Detecting Malicious Software by Monitoring Anomalous Windows Registry Accesses. Fifth International Symposium on Recent Advances in Intrusion Detection, RAID-2002. Zurich, Switzerland, 2002.
2. R. Balzer. Mediating Connectors. 19th IEEE International Conference on Distributed Computing Systems Workshop, 1994.
3. D. E. Denning, An intrusion detection model. IEEE Transactions on Software Engineering, 222, SE-13, 1987
4. E. Eskin. Anomaly Detection Over Noisy Data Using Learned Probability Distributions. In Proceedings of the 17th Intl Conf. on Machine Learning (ICML-2000), 2000.
5. E. Eskin, A. Arnold, M. Prerau, L. Portnoy and S. J. Stolfo. A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data. Data Mining for Security Applications. Kluwer 2002.
6. S. Forrest and S. A. Hofmeyr and A. Somayaji and T. A. Longstaff. A Sense of Self for UNIX Processes IEEE Symposium on Security and Privacy, 120-128, 1996
7. A. K. Ghosh, A. Schwartzbard, M. Schatz. Learning Program Behavior Profiles for Intrusion Detection. Workshop Intrusion Detection and Network Monitoring 1999.
8. K. A Heller, K. M Svore, A. D. Keromytis, and S. J. Stolfo. One Class Support Vector Machines for Detecting Anomalous Window Registry Accesses. 3rd IEEE Conference Data Mining Workshop on Data Mining for Computer Security. November 19, 2003.
9. H. S. Javitz and A. Valdes. The NIDES Statistical Component: Description and Justification. Technical report. SRI International, 1993.
10. W. Lee and S. J. Stolfo and P. K. Chan. Learning patterns from UNIX processes execution traces for intrusion detection AAAI Workshop on AI Approaches to Fraud Detection and Risk Management, 50-56, 1997
11. W. Lee and S. Stolfo. 1999. A Framework for Constructing Features and Models for Intrusion Detection Systems. In Proceedings of 1999 IEEE Symposium on Computer Security and Privacy and the Proceedings of the 8th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining. 1999.
12. M. V. Mahoney AND P. K. Chan. Detecting Novel Attacks by Identifying anomalous Network Packet Headers. Florida Institute of Technology Technical Report CS-2001-2, 1999.
13. R. Maxion, and T. Townsend. Masquerade Detection Using Truncated Command Lines. International Conference on Dependable Systems and Networks (DSN-02), Washington, D.C., 2002.
14. C. C. Michael and A. Ghosh. Simple, State-based approaches to Program-based Anomaly Detection. ACM Trans. on Information and System Security, TISSEC. Vol. 5., 2002.
15. L. Portnoy, E. Eskin and S. J. Stolfo. Intrusion detection with unlabeled data using clustering'. Proceedings of ACM CSS Workshop on Data Mining Applied to Security (DMSA-2001). Philadelphia, PA, 2001.
16. M. Schonlau, W. DuMouchel, W. Ju, A. F. Karr, M. Theus, and Y. Vardi. Computer intrusion: Detecting masquerades. Statistical Science, 16(1):58-74, February 2001.
17. K M.C. Tan and Roy A. Maxion. Why 6? Defining the Operational Limits of stide, an Anomaly-Based Intrusion Detector. IEEE Symp. On Security and Privacy. 2002.
18. C. Taylor and J. Alves-Foss. NATE: Network Analysis of Anomalous Traffic Events, a low-cost approach. In Proceedings New Security Paradigms Workshop, 2001.
19. G. Vigna, F. Valeur and R. Kemmerer. Designing and Implementing a Family of Intrusion Detection Systems. Proc. 9th European software engineering conference, 2003.
20. D. Wagner and P. Soto. Mimicry attacks on host based intrusion detection systems. Ninth ACM Conference on Computer and Communications Security, 2002.
21. K. Wang and S. Stolfo. One-Class Training for Masquerade Detection. 3rd IEEE International Conference on Data Mining, Workshop on Data Mining for Security Applications, Florida, Nov., 2003.
22. K. Wang, S. J. Stolfo. Anomalous Payload-based Network Intrusion Detection. RAID2004, France, September 2004.
23. C. Warrender, S. Forrest, and B. Pearluter. Detecting Intrusions Using System Calls: Alternative Data Models. IEEE Computer Society, 1999.
24. N. Ye. A Markov Chain Model of Temporal Behavior for Anomaly Detection. In Proceedings of the 2000 IEEE Workshop on Information Assurance and Security, United States Military Academy, West Point, NY. 2000.
25. E. Zadok and Jason Nieh. FiST: A Language for Stackable File Systems. Usenix Technical Conference. June 2000