A generalized feature extraction scheme to detect 0-day attacks via IDS alerts

Proceedings - 2008 International Symposium on Applications and the Internet, SAINT 2008

Volumn , Issue , 2008, Pages 55-61

  Song, Jungsuk ^a   Takakura, Hiroki ^a   Kwon, Yongjin ^b  

^a KYOTO UNIVERSITY   (Japan)

^b Hankuk Aviation University   (South Korea)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; INTERNET; INTRUSION DETECTION; LEARNING ALGORITHMS; NETWORK PROTOCOLS; PORTS AND HARBORS; SENSOR NETWORKS;

CYBER ATTACKS; DETECTION TIME; EXTRACTION METHODS; INTERNATIONAL SYMPOSIUM; INTRUSION-DETECTION SYSTEM; KYOTO UNIVERSITY; LEARNING TECHNIQUES; LOG DATA; ONE-CLASS SVM; SOURCE ADDRESS; TRAFFIC DATA;

FEATURE EXTRACTION;

EID: 53849091351     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SAINT.2008.85     Document Type: Conference Paper

References (23)

1. D. E. Denning, "An intrusion detection model", IEEE Transactions on Software Engineering, SE-13:222-232, 1987.
2. J. Allen, A. Christie, and W. Fithen, "State of the Practice of Intrusion Detection Technologies", Technical Report, CMU/SEI-99-TR-028, 2000.
3. M. M. Sebring, E. Shellhouse, M. E. Hanna, and R. Alan Whitehurst, "Expert systems in intrusion detection: A case study", In Proceedings of the 11th National Computer Security Conference, pp. 74-81, Baltimore, Maryland, October, 1988.
4. L. Portnoy, E. Eskin and S. Stolfo, "Intrusion Detection with Unlabeled Data Using Clustering", In Proceedings of ACM CSS Workshop on Data Mining Applied to Security, 2001.
5. E. Eskin, A. Arnold, M. Prerau, L. Portnoy and S. Stolfo, "A Geometric Framework for Unsupervised Anomaly Detection: Intrusion Detection in Unlabeled Data", In Applications of Data Mining in Computer Security, 2002.
6. Y. Guan, A. Ghorbani and N. Belacel, "Y-means: A Clustering Method for Intrusion Detection", In IEEE Canadian Conference on Electrical and Computer Engineering, Proceedings, 2003.
7. Laskov, P., Schäfer, C., Kotenko, I., "Intrusion detection in unlabeled data with quarter-sphere support vector machines", In: Proc. DIMVA, pp. 71-82, 2004.
8. Q. Wang, and V. Megalooikonomou, "A Clustering Algorithm for Intrusion Detection", In SPIE Conference on Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security, 2005.
9. Manganaris, S., Christensen, M., Zerkle, D. and Hermiz, K., "A Data Mining Analysis of RTID Alarms", Computer Networks 34 (4), Elsevier North-Holland, Inc., pp. 571-577, 2000.
10. Julisch, K., "Clustering Intrusion Detection Alarms to Support Root Cause Analysis", ACM Transactions on Information and System Security 6(4), ACM Press, pp. 443-471, 2003.
11. J. SONG, H. OHBA, H. TAKAKURA, Y. OKABE, K. OHIRA and Y. KWON, "A Comprehensive Approach to Detect Unknown Attacks via Intrusion Detection Alerts", ASIAN2Q07 Focusing on Computer and Network Security, LNCS 4846, pp. 247-253, Doha Qatar, December 2007.
12. Symantec Network Security 7100 Series.
13. http://www.ren-isac.net/
14. https://www.telecom-isac.jp/index.html(Japanes only)
15. The third international knowledge discovery and data mining tools competition dataset KDD99-Cup http://kdd.ics.uc i.edu/databases/kddcup99/ kddcup99.html, 1999.
16. J. SONG, H. TAKAKURA, Y. OKABE and Y. KWON, "A Robust Feature Normalization Scheme and an Optimized Clustering Method for Anomalybased Intrusion Detection System", DASFAA 2007, LNCS 4443, pp. 140-151, Bangkok, April 2007.
17. Vapnik, V., "The nature of statistical learning theory", Springer Verlag, New York, 1995.
18. Vapnik, V., "Statistical Learning Theory", Wiley, New York, 1998.
19. Scholkopf, B., Platt, J., Shawe-Taylor, J., Smola, A., and Williamson, R., "Estimating the support of a high-dimensional distribution", Neural Computation, 13(7):1443-1471, 2001.
20. Platt, J., "Fast training of support vector machines using sequential minimal optimization.", In Advances in kernel methods-Support vector learning, Cambridge, MA: MIT Press, pp. 185-208, 1999.
21. http://www.secure-ware.com/contents/product/ashula.html
22. http://www.sophos.com/security/analyses/w32allapleb.html
23. Lippmann R, Fried D, Graf I, Haines J, Kendall K, McClung D, Weber D, Webster S, Wyschogrod D, Cunningham R, Zissman M., "Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation", Proceedings of the DARPA Information Survivability Conference and Exposition, January 2000. IEEE Computer Society, Los Alamitos, CA, pp. 12-26, 2000.