Using self-organizing maps to build an attack map for forensic analysis

ACM International Conference Proceeding Series

Volumn , Issue , 2006, Pages

  Gunes Kayacik H ^a   Nur Zincir Heywood, A ^a  

^a DALHOUSIE UNIVERSITY   (Canada)

Author keywords

intrusion detection; KDD 99 intrusion detection datasets; neural networks; self organizing map

Indexed keywords

COMPUTER CRIME; CONFORMAL MAPPING; INTRUSION DETECTION; TOPOLOGY; ZERO-DAY ATTACK;

ATTACK BEHAVIOR; BEHAVIORAL MODEL; FORENSIC ANALYSIS; INTRUSION-DETECTION; KDD 99 INTRUSION DETECTION DATASET; NEURAL-NETWORKS; SECURITY EXPERTS; SELF-ORGANIZING FEATURE MAP; SELF-ORGANIZING-MAPS;

SELF ORGANIZING MAPS;

EID: 67650386290     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1501434.1501474     Document Type: Conference Paper

References (16)

1. The 1998 intrusion detection off-line evaluation plan. MIT Lincoln Lab., Information Systems Technology Group. http://www.11.mit.edu/IST/ideval/docs/1998/id98-eval-11.txt, 25 March 1998.
2. Knowledge discovery in databases DARPA archive. Task Description. http://www.kdd.ics.uci.edu/databases/kddcup99/task.html
3. J. McHugh, "Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory," ACM Transactions on Information and System Security, 3(4), pp. 262-294, 2001.
4. Paxson V., "Bro: A System for Detecting Network Intruders in Real-Time", Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999.
5. S. Hettich, S.D. Bay, The UCI KDD Archive. Irvine, CA: University of California, Department of Information and Computer Science, http://kdd.ics.uci.edu, 1999.
6. T. Kohonen, Self-Organizing Maps. 3rd Ed., Springer-Verlag, ISBN 3-540-67921-9, 2000.
7. R. Becker, S. Eick, and A. Wilks, "Visualizing network data", IEEE Transactions on Visualization and Computer Graphics, vol. 1, pp. 16-28, March 1995.
8. K. Cox and S. Eick, "Case study: 3d displays of Internet traffic", in Proceedings of Information Visualization (INFOVIS), IEEE Computer Society, pp. 129-131, Oct. 1995.
9. K. Abdullah, C. Lee, G. Conti and J. Copeland; "Visualizing Network Data for Intrusion Detection" IEEE Information Assurance Workshop (IAW) June 2002.
10. S. Kaski & T. Kohonen. Exploratory Data Analysis by the Self-Organizing Map: Structures of Welfare and Poverty in the World, Proceedings of the Third International Conference on Neural Networks in the Capital Markets, World Scientific, Singapore, 1995, 498-507.
11. Ultsch A. and Siemon H. "Kohonen's self-organizing feature maps for exploratory data analysis", In Proceedings of the International Neural Network Conference (INNC'90), Dordrecht, Netherlands, pages 305-308. Kluwer, 1990.
12. Kayacik H. G., Zincir-Heywood A. N., Heywood M. I., "Selecting Features for Intrusion Detection: A Feature Relevance Analysis on KDD 99 Intrusion Detection Datasets", Proceedings of the Third Annual Conference on Privacy, Security and Trust (PST-2005), October 2005.
13. K. Kendall, "A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems", S.M. Thesis, MIT Department of Electrical Engineering and Computer Science, June 1999. http://citeseer.ist.psu.edu/kendall99database.html
14. Han J., Kamber M., "Data Mining: Concepts and Techniques", Morgan Kaufmann, 2000, ISBN 7-04-010041, Ch. 5.
15. Spitzner L., "The Honeynet Project: Trapping the Hackers", IEEE Security & Privacy March-April 2003 (Vol. 1, No. 2) pp. 15-23
16. Symantec Internet Security Threat Report, Trends for July 05-December 05, Volume IX, Published March 2006 http://www.symantec.com/enterprise/threatreport/index.jsp