User profiling for intrusion detection using dynamic and static behavioral models

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2336, Issue , 2002, Pages 494-505

  Yeung, Dit Yan ^a   Ding, Yuxin ^a  

^a HONG KONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Hong Kong)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION; BEHAVIORAL RESEARCH; DATA MINING; DIGITAL STORAGE; ENTROPY; FAULT TOLERANT COMPUTER SYSTEMS; HIDDEN MARKOV MODELS; MAXIMUM LIKELIHOOD; NETWORK SECURITY;

DETECTION APPROACH; DYNAMIC MODELING APPROACH; FREQUENCY DISTRIBUTIONS; HYPOTHESIS TESTING; INSTANCE BASED LEARNING; NOVELTY DETECTION; PRINCIPLE OF MINIMUM CROSS ENTROPY; STORAGE REQUIREMENTS;

INTRUSION DETECTION;

EID: 78651413507     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/3-540-47887-6_49     Document Type: Conference Paper

References (23)

1. L.E. Baum, T. Petrie, G. Soules, and N. Weiss. A maximization technique occurring in the statistical analysis of probabilistic functions of Markov chains. Annals of Mathematical Statistics, 41(1):164–171, 1970.
2. C.M. Bishop. Novelty detection and neural network validation. IEE Proceedings: Vision, Image and Signal Processing, 141(4):217–222, 1994.
3. P.R. Cohen. Empirical Methods for Artificial Intelligence. MIT Press, Cambridge, MA, USA, 1995.
4. W.J. Daunicht. Autoassociation and novelty detection by neuromechanics. Science, 253(5025):1289–1291, 1991.
5. A.P. Dempster, N.M. Laird, and D.B. Rubin. Maximum likelihood from incomplete data via the EM algorithm (with discussion). Journal of the Royal Statistical Society, Series B, 39:1–38, 1977.
6. D.E. Denning. An intrusion-detection model. IEEE Transactions on Software Engineering, 13(2):222–232, 1987.
7. D. Endler. Intrusion detection: applying machine learning to Solaris audit data. In Proceedings of the Fourteenth Annual Computer Security Applications Conference, pages 268–279, Phoenix, AZ, USA, 7–11 December 1998.
8. S. Forrest, S.A. Hofmeyr, A. Somayaji, and T.A. Longstaff. A sense of self for Unix processes. In Proceedings of the IEEE Symposium on Security and Privacy, pages 120–128, Oakland, CA, USA, 6–8 May 1996.
9. D. Gunetti and G. Ruffo. Intrusion detection through behavioral data. In Proceedings of the Third International Symposium on Intelligent Data Analysis, pages 383–394, Amsterdam, Netherlands, 9-11 August 1999.
10. G.G. Helmer, J.S.K. Wong, V. Honavar, and L. Miller. Intelligent agents for intrusion detection. In Proceedings of the 1998 IEEE Information Technology Conference-Information Environment for the Future, pages 121–124, Syracuse, NY, USA, 1-3 September 1998.
11. N. Japkowicz, C. Myers, and M. Gluck. A novelty detection approach to classification. In Proceedings of the Fourteenth International Joint Conference on Artificial Intelligence, volume 1, pages 518–523, Montréal, Quebec, Canada, 20–25 August 1995.
12. R.W. Johnson and J.E. Shore. Comments on and correction to’axiomatic derivation of the principle of maximum entropy and the principle of minimum crossentropy’ (Jan 80 26–37). IEEE Transactions on Information Theory, 29(6):942–943, 1983.
13. S. Kullback and R.A. Leibler. On information and sufficiency. Annals of Mathematical Statistics, 22:79–86, 1951.
14. T. Lane. Hidden Markov models for human/computer interface modeling. In Proceedings of the IJCAI-99 Workshop on Learning about Users, pages 35–44, Stockholm, Sweden, 31 July 1999.
15. T. Lane and C.E. Brodley. Temporal sequence learning and data reduction for anomaly detection. In Proceedings of the Fifth ACM Conference on Computer and Communications Security, pages 150–158, San Francisco, CA, USA, 2–5 November 1998.
16. T. Lane and C.E. Brodley. Temporal sequence learning and data reduction for anomaly detection. ACM Transactions on Information and System Security, 2(3):295–331, 1999.
17. W. Lee and S.J. Stolfo. Data mining approaches for intrusion detection. In Proceedings of the Seventh USENIX Security Symposium, pages 79–93, San Antonio, TX, USA, 26-29 January 1998.
18. W. Lee, S.J. Stolfo, and K.W. Mok. A data mining framework for building intrusion detection models. In Proceedings of the IEEE Symposium on Security and Privacy, pages 120–132, Oakland, CA, USA, 9-12 May 1999.
19. L.R. Rabiner. A tutorial on hidden Markov models and selected applications in speech recognition. Proceedings of the IEEE, 77(2):257–286, 1989.
20. J. Ryan, M.J. Lin, and R. Miikkulainen. Intrusion detection with neural networks. In M.I. Jordan, M.J. Kearns, and S.A. Solla, editors, Advances in Neural Information Processing Systems 10, pages 943–949. MIT Press, 1998.
21. M. Schonlau and M. Theus. Detecting masquerades in intrusion detection based on unpopular commands. Information Processing Letters, 76(1/2):33–38, 2000.
22. J.E. Shore and R.W. Johnson. Axiomatic derivation of the principle of maximum entropy and the principle of minimum cross-entropy. IEEE Transactions on Information Theory, 26(1):26–37, 1980.
23. C. Warrender, S. Forrest, and B. Pearlmutter. Detecting intrusions using system calls: alternative data models. In Proceedings of the IEEE Symposium on Security and Privacy, pages 133–145, Oakland, CA, USA, 9-12 May 1999.