Abstracting audit data for lightweight intrusion detection

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6503 LNCS, Issue , 2010, Pages 201-215

  Wang, Wei ^a   Zhang, Xiangliang ^b   Pitsilis, Georgios ^a  

^a UNIVERSITY OF LUXEMBOURG   (Luxembourg)

^b KING ABDULLAH UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Saudi Arabia)

Author keywords

[No Author keywords available]

Indexed keywords

AFFINITY PROPAGATION; ANOMALY INTRUSION DETECTION; AUDIT DATA; DATA ABSTRACTION; DETECTION EFFICIENCY; DETECTION MODELS; DETECTION PERFORMANCE; HIGH SPEED; HTTP TRAFFIC; K-MEANS; POTENTIAL SOLUTIONS; REAL TIME PERFORMANCE; TEST RESULTS;

ABSTRACTING; CLUSTERING ALGORITHMS; COMPUTER AIDED LANGUAGE TRANSLATION; COMPUTER CRIME; DATA FLOW ANALYSIS; DATA PROCESSING; FEATURE EXTRACTION; INFORMATION SYSTEMS; PRINCIPAL COMPONENT ANALYSIS; COMPUTER SUPPORTED COOPERATIVE WORK; DATA HANDLING; EFFICIENCY; EXTRACTION; MERCURY (METAL); NETWORK SECURITY;

INTRUSION DETECTION;

EID: 78650860002     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-17714-9_15     Document Type: Conference Paper

References (34)

1. Beale, J., Baker, A.R., Caswell, B.: Snort 2.1 Intrusion Detection, 2nd edn. Syngress Press (2004)
2. Lee, W., Stolfo, S.J., Mok, K.W.: A data mining framework for building intrusion detection models. In: IEEE S&P (1999)
3. Wang, K., Stolfo, S.J.: Anomalous payload-based network intrusion detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 203-222. Springer, Heidelberg (2004)
4. Wang, K., Cretu, G.F., Stolfo, S.J.: Anomalous payload-based worm detection and signature generation. In: Valdes, A., Zamboni, D. (eds.) RAID 2005. LNCS, vol. 3858, pp. 227-246. Springer, Heidelberg (2006)
5. Forrest, S., Hofmeyr, S.A., Somayaji, A., Longstaff, T.A.: A sense of self for unix processes. In: IEEE S&P (1996)
6. Guan, X., Wang, W., Zhang, X.: Fast intrusion detection based on a non-negative matrix factorization model. J. Network and f Applications 32(1), 31-44 (2009)
7. Wang, W., Guan, X., Zhang, X., Yang, L.: Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data. Computers & Security 25(7), 539-550 (2006)
8. Liao, Y., Vemuri, V.R.: Using text categorization techniques for intrusion detection. In: USENIX Security Symposium (2002)
9. Schonlau, M., Theus, M.: Detecting masquerades in intrusion detection based on unpopular commands. Inf. Process. Lett. 76(1-2) (2000)
10. Wang, W., Guan, X., Zhang, X.: Processing of massive audit data streams for real-time anomaly intrusion detection. Computer Communications 31(1), 58-72 (2008)
11. Ingham, K.L., Inoue, H.: Comparing anomaly detection techniques for http. In: Kruegel, C., Lippmann, R., Clark, A. (eds.) RAID 2007. LNCS, vol. 4637, pp. 42-62. Springer, Heidelberg (2007)
12. Krügel, C., Vigna, G.: Anomaly detection of web-based attacks. In: ACM CCS (2003)
13. Song, Y., Keromytis, A.D., Stolfo, S.J.: Spectrogram: A mixture-of-markov-chains model for anomaly detection in web traffic. In: NDSS (2009)
14. Robertson, W.K., Vigna, G., Krügel, C., Kemmerer, R.A.: Using generalization and characterization techniques in the anomaly-based detection of web attacks. In: NDSS
15. Brauckhoff, D., Salamatian, K., May, M.: A signal-processing view on packet sampling and anomaly detection. In: INFOCOM (2010)
16. Brauckhoff, D., Tellenbach, B.,Wagner, A., Lakhina, A., May, M.: Impact of packet sampling on anomaly detection metrics. In: Internet Measurement Conference, IMC (2006)
17. Frey, B.J., Dueck, D.: Clustering by passing messages between data points. Science 315(5814), 972-976 (2007)
18. MacQueen, J.B.: Some methods for classification and analysis of multivariate observations. In: Proceedings of 5th Berkeley Symposium on Mathematical Statistics and Probability (1967)
19. Denning, D.E.: An intrusion-detection model. IEEE Trans. Software Eng. 13(2), 222-232 (1987)
20. Smaha, S.E.: Haystack: An intrusion detection system. In: Proceedings of the IEEE Fourth Aerospace Computer Security Applications Conference (1988)
21. Cretu, G.F., Stavrou, A., Locasto, M.E., Stolfo, S.J., Keromytis, A.D.: Casting out demons: Sanitizing training data for anomaly sensors. In: IEEE S&P (2008)
22. KDD-Data: Kdd cup 1999 data (1999), http://kdd.ics.uci.edu/databases/ kddcup99/kddcup99.html (retrieved March 2009)
23. Shyu, M., Chen, S., Sarinnapakorn, K., Chang, L.: A novel anomaly detection scheme based on principal component classifier. In: IEEE Foundations and New Directions of Data Mining Workshop (2003)
24. Sung, A.H., Mukkamala, S.: Feature selection for intrusion detection using neural networks and support vector machines. In: 82nd Annual Meeting of the Transportation Research Board (2003)
25. Wang, W., Gombault, S., Guyet, T.: Towards fast detecting intrusions: using key attributes of network traffic. In: ICIMP (July 2008)
26. Li, Y., Lu, T.B., Guo, L., Tian, Z.H., Qi, L.: Optimizing network anomaly detection scheme using instance selection mechanism. In: Proceedings of the 28th IEEE Conference on Global Telecommunications, GLOBECOM 2009, Piscataway, NJ, USA, pp. 425-431. IEEE Press, Los Alamitos (2009)
27. Wang,W., Zhang, X., Gombault, S.: Constructing attribute weights from computer audit data for effective intrusion detection. J. Sys. and Soft. 82(12) (2009)
28. Schölkopf, B., Platt, J.C., Shawe-Taylor, J., Smola, A.J., Williamson, R.C.: Estimating the support of a high-dimensional distribution. Neural Computation 13(7), 1443-1471 (2001)
29. Liao, Y., Vemuri, V.R., Pasos, A.: Adaptive anomaly detection with evolving connectionist systems. J. Network and Computer Applications 30(1) (2007)
30. Manevitz, L.M., Yousef, M.: One-class svms for document classification. Journal of Machine Learning Research 2, 139-154 (2001)
31. Jolliffe, I.T.: Principal Component Analysis, 2nd edn. Springer, Berlin (2002)
32. Zhang, X., Furtlehner, C., Sebag, M.: Data streaming with affinity propagation. In: Daelemans, W., Goethals, B., Morik, K. (eds.) ECML PKDD 2008, Part II. LNCS (LNAI), vol. 5212, pp. 628-643. Springer, Heidelberg (2008)
33. McHugh, J.: Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur. 3(4), 262-294 (2000)
34. Chang, C.C., Lin, C.J.: LIBSVM: a library for support vector machines (2001), Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm