An adaptive anomaly detector for worm detection

2nd Workshop on Tackling Computer Systems Problems with Machine Learning Techniques, SysML 2007, co-located with NSDI 2007

Volumn , Issue , 2007, Pages

  Agosta, John Mark ^a   Diuk Wasser, Carlos ^b   Chandrashekar, Jaideep ^a   Livadas, Carl ^a  

^a INTEL RESEARCH   (United States)

^b RUTGERS UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DISTRIBUTED DATABASE SYSTEMS; SUPERVISED LEARNING;

ADAPTIVE THRESHOLD DETECTORS; CENTRALIZED SYSTEMS; DETECTION THRESHOLD; PERFORMANCE CRITERION; RESOURCE LIMITATIONS; SUPERVISED CLASSIFIERS; TRAINING AND TESTING; WORM DETECTION SYSTEM;

LEARNING SYSTEMS;

EID: 80052182829     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. Ravi Sahita Gayathri Nagabhushan Priya Rajagopal David Durham, U. S. An os independent heuristics-based worm-containment system, 2005. Intel Tech.
2. Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., and Salamatian, K. Traffic classification on the fly. Computer Communication Review 36, 2 (2006), 23-26.
3. Bro intrusion detection system, 2006. http://http://bro-ids. org/.
4. Burgess, M. Probabilistic anomaly detection in distributed computer networks. Sci. Comput. Program. 60, 1 (2006), 1-26.
5. Dash, D., Kveton, B., Agosta, J. M., Schooler, E. M., Chandrashekar, J., Bachrach, A., and Newman, A. When gossip is good: Distributed probabilistic inference for detection of slow network intrusions. In AAAI (2006), AAAI Press.
6. Erman, J., Arlitt, M., and Mahanti, A. Traffic classification using clustering algorithms. In MineNet'06: Proceedings of the 2006 SIGCOMM workshop on Mining network data (New York, NY, USA, 2006), ACM Press, pp. 281-286.
7. Hellerstein, J. L., Zhang, F., and Shahabuddin, P. A statistical approach to predictive detection. Computer Networks 35, 1 (2001), 77-95.
8. Huang, J., and Ling, C. X. Using auc and accuracy in evaluating learning algorigthms. IEEE Transactions on Knowledge and Data Engineering 17, 3 (2006), 299-310.
9. Karagiannis, T., Papagiannaki, K., and Faloutsos, M. Blinc: multilevel traffic classification in the dark. In SIGCOMM (2005), R. Guérin, R. Govindan, and G. Minshall, Eds., ACM, pp. 229-240.
10. Lakhina, A., Crovella, M., and Diot, C. Characterization of network-wide anomalies in traffic flows. In Internet Measurement Conference (2004), A. Lombardo and J. F. Kurose, Eds., ACM, pp. 201-206.
11. McGregor, A., Hall, M., Lorier, P., and Brunskill, J. Flow clustering using machine learning techniques. In PAM (2004), C. Barakat and I. Pratt, Eds., vol. 3015 of Lecture Notes in Computer Science, Springer, pp. 205-214.
12. Moore, A. W., and Zuev, D. Internet traffic classification using bayesian analysis techniques. In SIGMETRICS'05: Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems (New York, NY, USA, 2005), ACM Press, pp. 50-60.
13. Roughan, M., Sen, S., Spatscheck, O., and Duffield, N. Class-of-service mapping for qos: a statistical signature-based approach to ip traffic classification. In IMC'04: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement (New York, NY, USA, 2004), ACM Press, pp. 135-148.
14. Weka 3: Data mining software in java, 2006. http://www.cs.waikato.ac.nz/ml/weka/.
15. Windump: tcpdump for windows, 2006. http://www.winpcap.org/windump/.