Network anomaly detector based on the D-S evidence theory

Ruan Jian Xue Bao/Journal of Software

Volumn 17, Issue 3, 2006, Pages 463-471

  Zhuge, Jian Wei ^a   Wang, Da Wei ^a   Chen, Yu ^a   Ye, Zhi Yuan ^a   Zou, Wei ^a  

^a PEKING UNIVERSITY   (China)

Author keywords

Anomaly detection; D S theory; Data fusion; Evidence theory; Intrusion detection

Indexed keywords

ADAPTIVE ALGORITHMS; DATA PROCESSING; DETECTORS; NETWORKS (CIRCUITS);

ANOMALY DETECTION; BASIC PROBABILITY ASSIGNMENT (BPA); DATA FUSION; DATA SET; DEMPSTER-SHAFER (D-S) THEORY; DYNAMIC NETWORKS; EVIDENCE THEORY; FALSE ALARM RATE; HIGH SPEED NETWORKS; INTRUSION DETECTION; LIGHT COMPUTATION; NETWORK FLOW; NETWORK TRAFFIC; REAL TIME; SELF ADAPTATION MECHANISMS;

ERROR DETECTION;

EID: 33646754276     PISSN: 10009825     EISSN: None     Source Type: Journal    
DOI: 10.1360/jos170463     Document Type: Article

References (19)

1. Heberlein L, Dias GV, Levitt KN, Mukherjee B, Wood J, Wolber D. A network security monitor. In: Proc. of the IEEE Computer Society Symp. Research in Security and Privacy. 1990. 296-304. http://seclab.cs.ucdavis.edu/papers/pdfs/th-gd-90.pdf
2. Valdes A, Skinner K. Adaptive, model-based monitoring for cyber attack detection. In: Debar H, Mé L, Wu SF, eds. Proc. of the 3rd Int'l Workshop on the Recent Advances in Intrusion Detection (RAID 2000). LNCS 1907, Heidelberg: Springer-Verlag, 2000. 80-92.
3. Staniford S, Hoagland JA, McAlerney JM. Practical automated detection of stealthy portscans. Journal of Computer Security, 2002, 10(1/2): 105-136.
4. Mahoney VM. A machine learning approach to detecting attacks by identifying anomalies in network traffic[Ph.D. Thesis]. Melbourne: Florida Institute of Technology, 2003.
5. Wang K, Stolfo SJ. Anomalous payload-based network intrusion detection. In: Jonsson E, Valdes A, Almgren M, eds. Proc. of the 7th Int'l Symp. on Recent Advances in Intrusion Detection (RAID 2004). LNCS 3224, Heidelberg: Springer-Verlag, 2004. 203-222.
6. Krugel C, Toth T, Kirda E. Service specific anomaly detection for network intrusion detection. In: Lamont GB, Haddad H, Papadopoulos G, Panda B, eds. Proc. of the 2002 ACM Symp. on Applied Computing. New York: ACM Press, 2002. 201-208.
7. Lee W, Stolfo SJ. A framework for constructing features and models for intrusion detection systems. ACM Trans. on Information and System Security, 2000, 3(4): 227-261.
8. Manikopoulos C, Papavassiliou S. Network intrusion and fault detection: A statistical anomaly approach. IEEE Communications Magazine, 2002, 40(10): 76-82.
9. Zhang J, Gong J. An anomaly detection method based on fuzzy judgment. Journal of Computer Research and Development, 2003, 40(6): 776-783 (in Chinese with English abstract).
10. Aickelin U, Greensmith J, Twycross J. Immune system approaches to intrusion detection-A review. In: Nicosia G, et al., eds. Proc. of the 3rd Int'l Conf. on Artificial Immune Systems. LNCS 3239, Heidelberg: Springer-Verlag, 2004. 316-329.
11. Rao X, Dong CX, Yang SQ. An intrusion detection system based on support vector machine. Journal of Software, 2003, 14(4): 798-803 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/14/798.htm
12. Li KL, Huang HK, Tian SF, Liu ZP, Liu ZQ. Fuzzy multi-class support vector machine and application in intrusion detection. Chinese Journal of Computers, 2005, 28(2): 274-280 (in Chinese with English abstract).
13. Xiao Y, Han CH, Zheng QH, Wang Q. Network intrusion detection method based on multi-class support vector machine. Journal of Xi'an Jiaotong University, 2005, 39(6): 562-565 (in Chinese with English abstract).
14. McHugh J. Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA offline intrusion detection system evaluation as performed by Lincoln laboratory. ACM Trans. on Information and System Security, 2000, 3(4): 262-294.
15. Porras PA, Neumann PG. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In: Proc. of the 20th National Information Systems Security Conf. Baltimore. 1997. 353-365. http://www.csl.sri.com/papers/emerald-niss97/
16. Dempster A. Upper and lower probabilities induced by multivalued mapping. Annals of Mathematical Statistics, 1967, 38(2): 325-339.
17. Siaterlis C, Maglaris B. Towards multisensor data fusion for DoS detection. In: Haddad HM, Omicini A, Wainwright RL, Liebrock LM, eds. Proc. of the 2004 ACM Symp. on Applied Computing. New York: ACM Press, 2004. 439-446.
18. Orponen P. Dempster's rule of combination is #P-complete. Artificial Intelligence, 1990, 44(1-2): 245-253.
19. Adamic LA, Huberman BA. Zipf's law and the Internet. Glottometrics 3, 2002. 143-150.