Using an ensemble of one-class SVM classifiers to harden payload-based anomaly detection systems

Proceedings - IEEE International Conference on Data Mining, ICDM

Volumn , Issue , 2006, Pages 488-498

  Perdisci, Roberto ^a,b   Gu, Ofei ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

^b UNIVERSITY OF CAGLIARI   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION SYSTEMS; BYTE SUBSTITUTIONS; MIMICRY ATTACKS; PACKET CONTENTS; PADDING TECHNIQUES;

CLASSIFICATION (OF INFORMATION); CLUSTERING ALGORITHMS; FEATURE EXTRACTION; MATHEMATICAL MODELS; PACKET NETWORKS; STATISTICAL METHODS; TEXT PROCESSING;

SUPPORT VECTOR MACHINES;

EID: 60349101742     PISSN: 15504786     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICDM.2006.165     Document Type: Conference Paper

References (29)

1. Securityfocus (BID 2674). Microsoft IIS 5.0 .printer ISAPI Extension buffer overflow vulnerability, 2006.
2. Securityfocus (BID 3526). ActivePerl perlIIS.dll buffer overflow vulnerability, 2006.
3. R. Brunelli and D. Falavigna. Person identification using multiple cues. IEEE Trans. on Pattern Analysis and Machine Intelligence, 17(10):955-966, 1995.
4. C. Chang and C. Lin. LIBSVM: a library for support vector machines, 2001.
5. R. Chinchani and E.V.D. Berg. A fast static analysis approach to detect exploit code inside network flows. In Recent Advances in Intrusion Detection (RAID), 2005.
6. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. Underduk. Polymorphic shellcode engine using spectrum analysis. Phrack Issue 0x3d, 2003.
7. I. S. Dhillon, S. Mallela, and R. Kumar. A divisive information-theoretic feature clustering algorithm for text classification. Journal of Machine Learning Research, 3:1265-1287, 2003.
8. T. G. Dietterich. Ensemble methods in machine learning. In Multiple Classifier Systems (MCS), 2000.
9. R. O. Duda, P. E. Hart, and D. G. Stork. Pattern Classification. Wiley, 2000.
10. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo. A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data. In D. Barbara and S. Jajodia, editors, Applications of Data Mining in Computer Security. Kluwer, 2002.
11. FirewOrker. Windows Media Services remote command execution exploit, 2006.
12. P. Fogla, M. Sharif, R. Perdisci, O. M. Kolesnikov, and W Lee. Polymorphic blending attack. In USENIX Security Symposium, 2006.
13. G. Giacinto, F. Roli, and L. Didaci. Fusion of multiple classifiers for intrusion detection in computer networks. Pattern Recognition Letters, 24(12): 1795-1803, 2003.
14. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Automating mimicry attacks using static binary analysis. In USENIX Security Symposium, 2005.
15. C. Kruegel, T. Toth, and E. Kirda. Service specific anomaly detection for network intrusion detection. In ACM Symposium on Applied Computing (SAC), 2002.
16. L. Kuncheva. Combining Pattern Classifiers. Wiley, 2004.
17. E. Leopold and J. Kindermann. Text categorization with support vector machines. How to represent texts in input space? Machine Learning, 46:423-444, 2002.
18. M. Mahoney. Network traffic anomaly detection based on packet bytes. In ACM Symposium on Applied Computing (SAC), 2003.
19. J. McHugh, A. Christie, and J. Allen. Defending your-self: The role of intrusion detection systems. IEEE Software, pages 42-51, Sept./Oct. 2000.
20. L. Portnoy, E. Eskin, and S. Stolfo. Intrusion detection with unlabeled data using clustering. In ACM CSS Workshop on Data Mining Applied to Security, 2001.
21. B. Schölkopf, J. Platt, J. Shawe-Taylor, A. J. Smola, and RC Williamson. Estimating the support of a high-dimensional distribution. Neural Computation, 13:1443-1471, 2001.
22. F. Sebastiani. Machine learning in automated text categorization. ACM Computing Surveys, 34(1): 1-47, March 2002.
23. D. M. J. Tax. One-Class Classification, Concept Learning in the Absence of Counter Examples. PhD thesis, Delft University of Technology, Delft, Netherland, 2001.
24. D. M. J. Tax and R. P. W Duin. Combining oneclass classifiers. In Multiple Classifier Systems (MCS), 2001.
25. T. Toth and C. Kruegel. Accurate buffer overflow detection via abstract payload execution. In Recent Advances in Intrusion Detection (RAID), 2002.
26. V. Vapnik. Statistical Learning Theory. Wiley, 1998.
27. D. Wagner and P. Soto. Mimicry attacks on host-based intrusion detection systems. In ACM Conference on Computer and Communication Security (ACM CCS), 2002.
28. K. Wang and S. Stolfo. Anomalous payload-based network intrusion detection. In Recent Advances in Intrusion Detection (RAID), 2004.
29. K. Wang and S. Stolfo. Anomalous payload-based worm detection and signature generation. In Recent Advances in Intrusion Detection (RAID), 2005.