Noise-resistant payload anomaly detection for network intrusion detection systems

Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference

Volumn , Issue , 2008, Pages 517-523

  Kim, Sun Il ^a   Nwanze, Nnamdi ^b  

^a University of Alabama ^*  (United States)

^b State University of New York at Binghamton   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTIONS; ANOMALY-BASED INTRUSION DETECTIONS; DETECTION SCHEMES; FALSE POSITIVES; GLOBAL SECURITIES; INTRUSION DETECTION SCHEMES; NETWORK INTRUSION DETECTION SYSTEMS; PACKET DETECTIONS; TEST RESULTS; TUNING PARAMETERS;

COMPUTER CRIME; INTERNET;

INTRUSION DETECTION;

EID: 62849113350     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PCCC.2008.4745080     Document Type: Conference Paper

References (18)

1. R. Richardson, 2007 CSI Computer Crime And Security Survey, Computer Security Institute.
2. M. Roesch, "Snort - lightweight intrusion detection for networks," http://www.snort.org/docs/lisapaper.txt.
3. P. G. Neumann and P. A. Poras, "Experiences with emerald to date," in RAID 1999.
4. E. Eskin, A. Arnold, M. Prerau, L. Portnor, and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data," in Data Mining for Security App., Kluwer, 2002.
5. C. Kruegel, T. Toth, and E. Kirda, "Service specific anomaly detection for network intrusion detection," in Applied Computing (SAC), ACM Digital Library 2002.
6. M. Mahoney, "Network traffic anomaly detection based on packet bytes," in 18th ACM Symp. Applied Computing 2003.
7. A. Gupta and R. Sekar, "An approach for detecting self-propagating email using anomaly detection," in International Symp. on Recent Advances in Intrusion Detection 2003.
8. D. Summerville, N. Nwanze, and V. Skormin, "Anomalous packet identification for network intrusion detection," in 5th IEEE Systems, Man and Cybernetics Information Assurance Workshop 2004.
9. I. Onuta and A. Ghorbani, "Svision: A novel visual network-anomaly identification technique," computers and Security, vol. 26, Issue 3, pp 201-212, May 2007.
10. N. Nwanze and D. Summerville, "Detection of anomalous network packets using lightweight stateless payload inspection," 4th IEEE LCN Workshop on Network Security (WNS) 2008.
11. K. Labib and V. R. Vemuri, "An application of principal component analysis to the detection and visualization of computer network attacks," Annals of Telecommunications, Nov./Dec. 2005.
12. Y. Bouzida, F. Cuppens, N. Cuppens-Boulahia, and S. Gombault, "Efficient intrusion detection using principal, component analysis," www.rennes.enst-bretagne.fr/fcuppens/articles/sar04.pdf.
13. C. Taylor and J. Alves-Foss, "Nate-network analysis of anomolous traffic events, a low cost approach," in NSPW 2001.
14. K. Wang and S. J. Stolfo, "Anomalous payload-based network intrusion detection," in Columbia University Technical Report, Feb. 2nd, 2004, http://wwwl.cs.Columbia.edu/ids/publications/Payl-AD. 02.01.04-final.PDF.
15. K. Wang, J. J. Parekh, and S. J. Stolfo, "Anagram: A content anomaly detector resistant to mimicry attack," in RAID 2006.
16. G. Rache, M. Riopel, and J. G. Blais, "Non graphical solutions for the cattells scree test," 2006.
17. L. Hansen, "Generalizable patterns in neuroimaging: How many principal components," 1998.
18. I. T. Jolliffe, principal Component Analysis. New York: Springer, 1986.