Probabilistic anomaly detection in distributed computer networks

Science of Computer Programming

Volumn 60, Issue 1, 2006, Pages 1-26

  Burgess, Mark ^a  

^a OSLO METROPOLITAN UNIVERSITY   (Norway)

Author keywords

Anomaly detection; Data mining; Machine learning

Indexed keywords

ALGORITHMS; DATA MINING; HUMAN COMPUTER INTERACTION; LEARNING SYSTEMS; MATHEMATICAL MODELS; PROBABILITY; RESOURCE ALLOCATION; STORAGE ALLOCATION (COMPUTER);

ANOMALY DETECTION; COMPUTATIONAL OVERHEAD;

DISTRIBUTED COMPUTER SYSTEMS;

EID: 30344486259     PISSN: 01676423     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.scico.2005.06.001     Document Type: Article

References (57)

1. E. Al-Shaer, H. Hamed, Firewall policy advisor for anomaly detection and rule editing, in: Proc. IEEE/IFIP 8th Int. Symp. Integrated Network Management, IM 2003, March 2003, pp. 17-30
2. P. Barford, J. Kline, D. Plonka, A. Ron, A signal analysis of network traffic anomalies, 2002
3. K. Begnum, M. Burgess, A scaled, immunological approach to anomaly countermeasures, in: Proceedings of the VIII IFIP/IEEE IM Conference on Network Management, 2003
4. K. Begnum, and M. Burgess Principle components and importance ranking of distributed anomalies Machine Learning Journal 58 2005 217 230
5. G. Box, G. Jenkins, and G. Reinsel Time Series Analysis 1994 Prentice Hall New Jersey
6. H. Bunke, and J. Csirik Parametric string edit distance and its application to pattern recognition IEEE Transactions on Systems, Man and Cybernetics 25 1995 202
7. M. Burgess A site configuration engine Computing Systems vol. 8 1995 MIT Press Cambridge, MA 309
8. M. Burgess Computer immunology Proceedings of the Twelfth Systems Administration Conference (LISA XII) 1998 USENIX Association Berkeley, CA 283
9. M. Burgess Automated system administration with feedback regulation Software Practice and Experience 28 1998 1519
10. M. Burgess The kinematics of distributed computer transactions International Journal of Modern Physics, C 12 2000 759 789
11. M. Burgess, Two dimensional time-series for anomaly detection and regulation in adaptive systems, in: IFIP/IEEE 13th International Workshop on Distributed Systems: Operations and Management, DSOM 2002, 2002, p. 169
12. M. Burgess On the theory of system administration Science of Computer Programming 49 2003 1
13. M. Burgess Analytical Network and System Administration-Managing Human-Computer Systems 2004 J. Wiley & Sons Chichester
14. M. Burgess Cfengine www site http://www.iu.hio.no/cfengine 1993
15. M. Burgess, G. Canright, and K. Engø A graph theoretical model of computer security: from file access to social engineering International Journal of Information Security 3 2004 70 85
16. M. Burgess, H. Haugerud, T. Reitan, and S. Straumsnes Measuring host normality ACM Transactions on Computing Systems 20 2001 125 160
17. N. Damianou, N. Dulay, E.C. Lupu, M. Sloman, Ponder: a language for specifying security and management policies for distributed systems, Imperial College Research Report DoC 2000/1, 2000
18. D. Denning An intrusion detection model IEEE Transactions on Software Engineering 13 1987 222
19. P. D'haeseleer, An immunological approach to change detection: Theoretical results, in: 9th IEEE Computer Security Foundations Workshop, 1996
20. P. D'haeseleer, S. Forrest, P. Helman, An immunological approach to change detection: algorithms, analysis, and implications, in: Proceedings of the 1996 IEEE Symposium on Computer Security and Privacy, 1996
21. Y. Diao, J.L. Hellerstein, S. Parekh, Optimizing quality of service using fuzzy control, in: IFIP/IEEE 13th International Workshop on Distributed Systems: Operations and Management, DSOM 2002, 2002, p. 42
22. R.O. Duda, P.E. Hart, and D.G. Stork Pattern Classification 2001 Wiley Interscience New York
23. R. Durbin, S. Eddy, A. Krigh, and G. Mitcheson Biological Sequence Analysis 1998 Cambridge University Press Cambridge
24. S. Forrest, S. Hofmeyr, and A. Somayaji Communications of the ACM 40 1997 88
25. S. Forrest, S.A. Hofmeyr, A. Somayaji, T.A. Longstaff, Proceedings of 1996 IEEE Symposium on Computer Security and Privacy, 1996
26. J.A. Freeman, and D.M. Skapura Neural Networks: Algorithms, Applications and Programming Techniques 1991 Addison Wesley Reading
27. G.R. Grimmett, and D.R. Stirzaker Probability and Random Processes 3rd edition 2001 Oxford Scientific Publications Oxford
28. S.-H. Han, M.-S. Kim, H.-T. Ju, J.W.-K. Hong, The architecture of ng-mon: A passive network monitoring system for high-speed ip networks, in: IFIP/IEEE 13th International Workshop on Distributed Systems: Operations and Management, DSOM 2002, 2002, p. 16
29. S.A. Hofmeyr, A. Somayaji, and S. Forrest Intrusion detection using sequences of system calls Journal of Computer Security 6 1998 151 180
30. P. Hoogenboom, and J. Lepreau Computer system performance problem detection using time series models Proceedings of the USENIX Technical Conference 1993 USENIX Association Berkeley, CA 15
31. IETF, Intrusion detection exchange format, http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-14.txt
32. H.S. Javitz, and A. Valdes The SRI IDES Statistical Anomaly Detector Proceedings of the IEEE Symposium on Security and Privacy May 1991 1991 IEEE Press
33. J.O. Kephart A biologically inspired immune system for computers Proceedings of the Fourth International Workshop on the Synthesis and Simulation of Living Systems 1994 MIT Press Cambridge, MA 130
34. C. Kruegel, and G. Vigna Anomaly Detection of Web-based Attacks Proceedings of the 10th ACM Conference on Computer and Communication Security CCS'03, October 2003 2003 ACM Press 251 261
35. T. Lane, Machine learning techniques for the computer security, Ph.D. Thesis, Purdue University, 2000
36. W.E. Leland, M. Taqqu, W. Willinger, and D. Wilson On the self-similar nature of ethernet traffic IEEE/ACM Transactions on Networking 1994 1 15
37. H. Lewis, and C. Papadimitriou Elements of the Theory of Computation 2nd edition 1997 Prentice Hall New York
38. P. Matzinger Tolerance, danger and the extended family Annual Review Immunology 12 1994 991
39. W.D. McComb Renormalization Methods: A Guide for Beginners 2003 Oxford University Press
40. P.G. Neumann, P.A. Porras, Experience with EMERALD to date, 2000, pp. 73-80
41. B.J. Oommen, and R.L. Kashyap A formal theory for optimal and information theoretic syntactic pattern recognition Patter Recognition 31 1998 1159
42. V. Paxson Bro: A system for detecting network intruders in real time Proceedings of the 7th Security Symposium 1998 USENIX Association Berkeley, CA
43. V. Paxson, and S. Floyd Wide area traffic: the failure of Poisson modelling IEEE/ACM Transactions on Networking 3 3 1995 226
44. J. Pearl Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference 1988 Morgen Kaufmann San Francisco
45. P.A. Porras, P.G. Neumann, EMERALD: Event monitoring enabling responses to anomalous live disturbances, in: Proc. 20th NIST-NCSC National Information Systems Security Conference, 1997, pp. 353-365
46. M.J. Ranum Implementing a generalized tool for network monitoring Proceedings of the Eleventh Systems Administration Conference (LISA XI) 1997 USENIX Association Berkeley, CA 1
47. B.D. Ripley Pattern Recognition and Neural Networks 1996 Cambridge University Press Cambridge
48. M. Roesch Snort, Intrusion Detection System http://www.snort.org
49. K.I. Sato, Levy Processes and Infinitely Divisible Distributions, in: Cambridge Studies in Advanced Mathematics, Cambridge, 1999
50. R. Sekar, T. Bowen, M. Segal, On preventing intrusions by process behaviour monitoring, in: Proceedings of the Workshop on Intrusion Detection and Network Monitoring, USENIX, 1999
51. M.I. Seltzer, and C. Small Self-monitoring and self-adapting operating systems Proceedings of the Sixth Workshop on Hot Topics in Operating Systems 1997 IEEE Computer Society Press Cape Cod, MA, USA
52. C.E. Shannon, and W. Weaver The Mathematical Theory of Communication 1949 University of Illinois Press Urbana
53. M. Sloman Policy driven management for distributed systems Journal of Network and Systems Management 2 1994 333
54. A. Somayaji, S. Forrest, Automated response using system-call delays, in: Proceedings of the 9th USENIX Security Symposium, 2000, p. 185
55. A. Somayaji, S. Hofmeyr, and S. Forrest Principles of a computer immune system New Security Paradigms Workshop September 1997 1997 ACM 75 82
56. M. Steinder, A. Sethi, Distributed fault localization in hierarchically routed networks, in: IFIP/IEEE 13th International Workshop on Distributed Systems: Operations and Management, DSOM 2002, 2002, p. 195
57. M. Steinder, and A. Sethi A survey of fault localization techniques in computer networks Science of Computer Programming 53 2003 165