A methodology for designing accurate anomaly detection systems

4th International Latin American Networking Conference, LANC 2007

Volumn , Issue , 2007, Pages 139-144

  Ingham, Kenneth L ^a   Somayaji, Anil ^b  

^a MSC01 1070   (United States)

^b CARLETON UNIVERSITY   (Canada)

Author keywords

Anomaly detection; HTTP; Intrusion detection; Web server security

Indexed keywords

COMPUTER CRIME; DATA PROCESSING; DISTRIBUTED COMPUTER SYSTEMS; SIGNAL DETECTION;

ANOMALY DETECTION; ANOMALY DETECTION SYSTEMS; DATA PRE-PROCESSING; FALSE POSITIVES; HIGH RATES; MIMICRY ATTACKS; MODELING METHODS; WEB REQUESTS; WEB SERVER SECURITY;

INTRUSION DETECTION;

EID: 57349133735     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1384117.1384137     Document Type: Conference Paper

References (11)

1. K. P. Anchor, J. B. Zydallis, G. H. Gunsch, and G. B. Lamont. Extending the computer defense immune system: Network intrusion detection with a multiobjective evolutionary programming approach. In Proceedings of ICARIS 2002: 1st International Conference on Artificial Immune Systems Conference, 2002.
2. M. Damashek. Gauging similarity with n-grams: language-independent categorization of text. Science, 267(5199): 843-848, 1995.
3. P. Fogla, M. Sharif, R. Perdisci, O. Kolesnikov, and W. Lee. Polymorphic blending attacks. In USENIX-SS'06: Proceedings of the 15th conference on USENIX Security Symposium, pages 17-17, Berkeley, CA, USA, 2006. USENIX Association.
4. S. Forrest, S. Hofmeyr, A. Somayaji, and T. Longstaff. A sense of self for Unix processes. In 1996 IEEE Symposium on Security and Privacy, 6-8 May 1996, Oakland, CA, USA, pages 120-128, Los Alamitos, CA, USA, 1996. IEEE Computer Society Press.
5. K. L. Ingham. Anomaly Detection for HTTP Intrusion Detection: Algorithm Comparisons and the Effect of Generalization on Accuracy. PhD thesis, Department of Computer Science, University of New Mexico, Albuquerque, NM, 87131, 2007.
6. K. L. Ingham and H. Inoue. Comparing anomaly detection techniques for HTTP. In Recent Advances in Intrusion Detection, 2007.
7. K. L. Ingham, A. Somayaji, J. Burge, and S. Forrest. Learning DFA representations of HTTP for protecting web applications. Computer Networks, 51(5): 1239-1255, 11 April 2007.
8. C. Kruegel, G. Vigna, and W. Robertson. A multi-model approach to the detection of web-based attacks. Computer Networks, 48(5): 717-738, 2005.
9. Z. Li, A. Das, and J. Zhou. Model generalization and its implications on intrusion detection. In Applied Cryptography and Network Security, Third International Conference, ACNS 2005, New York, NY, USA, June 7-10, 2005, Proceedings, pages 222-237, 2005.
10. W. Robertson, G. Vigna, C. Kruegel, and R. A. Kemmerer. Using generalization and characterization techniques in the anomaly-based detection of web attacks. In Network and Distributed System Security Symposium Conference Proceedings: 2006. Internet Society, 2006.
11. K. Wang and S. J. Stolfo. Anomalous payload-based network intrusion detection. In Recent Advances in Intrusion Detection: 7th International Symposium, RAID 2004, Sophia Antipolis, France, September 15-17, 2004. Proceedings, volume 3224 of Lecture Notes in Computer Science, pages 203-222. Springer, 2004.