The utility of partial knowledge in behavior models: An evaluation for intrusion detection

International Journal of Network Security

Volumn 1, Issue 3, 2005, Pages 138-146

  Li, Zhuowei ^a   Das, Amitabha ^a  

^a NANYANG TECHNOLOGICAL UNIVERSITY   (Singapore)

Author keywords

Intrusion detection; Machine learning; Model evaluation; Model generalization; Security

Indexed keywords

BEHAVIOR IDENTIFICATIONS; BEHAVIOR MODEL; BEHAVIOR SIGNATURE; DETECTION CAPABILITY; M OF N FEATURES; MODEL EVALUATION; MODEL GENERALIZATION; PARTIAL KNOWLEDGE; SECURITY;

LEARNING SYSTEMS; NETWORK SECURITY; SAFETY ENGINEERING;

INTRUSION DETECTION;

EID: 77949272825     PISSN: 1816353X     EISSN: 18163548     Source Type: Journal    
DOI: None     Document Type: Article

References (19)

1. K. P. Anchor, J. B. Zydallis, G. H. Gunsch, and G. B. Lamont, "Extending the computer defense immune system: Network intrusion detection with a multi-objective evolutionary programming approach," in ICARIS 2002: 1st International Conference on Artificial Immune Systems Conference Proceedings, pp. 12-21, 2002.
2. S. Axelsson, "The base-rate fallacy and its implications for the difficulty of intrusion detection," in Proceedings of the 6th ACM conference on Computer and communications security, pp. 1-7, 1999.
3. S. N. Chari and P. Cheng, "BlueBox: A policy-driven, host-based intrusion detection system," ACM Transaction on Infomation and System Security, vol. 6, no. 2, pp. 173-200, May 2003.
4. D. Dasgupta and F. González, "An immunity-based technique to characterize intrusions in computer net-works," IEEE Transactions on Evol. Comput., vol. 6, no. 3, pp. 1081-1088, 2002.
5. H. Debar, M. Dacier, and A. Wespi, "A revised taxonomy for intrusion detection systems," Annales des Telecommunications, vol. 55, no. 7-8, pp. 361-378, 2000.
6. D. E. Denning, "An intrusion detection model," IEEE Transaction on Software Engineering, vol. SE-13, no. 2, pp. 222-232, Feb. 1987.
7. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo, "A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data," D. Barbara and S. Jajodia (editors), in em Applications of Data Mining in Computer Security, Kluwer, 2002.
8. S. A. Hofmeyr, S. Forrest, and A. Somayaji, "Intrusion detection using sequences of system calls," Journal of Computer Security, vol. 6, no. 3, pp. 151-180, 1998.
9. H. Javits and A. Valdes, The NIDES Statistical Component: Description and Justification, SRI Anual Report A010, SRI International, Computer Science Laboratory, March 1993.
10. W. Ju and Y. Vardi, "A hybrid high-order markov chain model for computer intrusion detection," Journal of Computational and Graphical Statistics, vol. 10, no. 2, pp. 277-295, 2001.
11. W. Lee, M. Miller, and S. Stolfo, Toward Cost-sensitive Modeling for Intrusion Detection, Technical Report No. CUCS-002-00, Computer Science, Columbia University, 2000.
12. W. Lee and S. J. Stolfo, "A framework for contructing features and models for intrusion detection sys-tems," ACM Transactions on Information and System Security, vol. 3, no. 4, pp. 227-261, Nov. 2000.
13. Y. Liao and V. R. Vemuri, "Using text categorization techniques for intrusion detection," in Usenix: Security 2002, pp. 51-59, Aug. 2002.
14. M. V. Mahoney and P. K. Chan, "Learning nonstationary models of normal network traffic for detecting novel attacks," in SIGKDD 2002, pp. 23-26, July 23-26 2002.
15. C. Manikopoulos and S. Papavassiliou, "Network intrusion and fault detection: A statistical anomaly approach," IEEE Communications Magazine, vol. 40, no. 10, pp. 76-82, Oct. 2002.
16. M. Ramadas, S. Ostermann, and B. Tjaden, "Detecting anomalous network traffic with self-organizing maps," in Sixth International Symposium on Recent Advances in Intrusion Detection (RAID 2003), Pitts-burgh, Pennsylvania, pp. 36-54, Sep. 8-10 2003.
17. R. Sekar, M. Bendre, D. Dhurjati, and P. Bolli-neni, "A fast automaton-based method for detecting anomalous program behaviors," in Proceedings of the 2000 IEEE Symposium on Security and Privacy, pp. 144-155, 2000.
18. K. Wang and S. J. Stolfo, "Anomalyous payload-based network intrusion detection," in Proceedings of RAID, pp. 203-222, 2004.
19. Wikipedia, Def. of 'Intrusion-Detection System', http://en.wikipedia.org/w/wiki.phtml?title=Intrusion-detection_system.