Intrusion as (anti)social communication: Characterization and detection

Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

Volumn , Issue , 2012, Pages 886-894

  Ding, Qi ^a   Katenka, Natallia ^a   Barford, Paul ^b   Kolaczyk, Eric ^a   Crovella, Mark ^a  

^a BOSTON UNIVERSITY   (United States)

^b UNIVERSITY OF WISCONSIN   (United States)

Author keywords

intrusion detection; social graphs

Indexed keywords

EDGE NETWORKS; FLOW DATA; INTRUSION DETECTION SYSTEMS; NETWORK EDGES; SOCIAL GRAPHS;

COMMUNICATION; DATA MINING;

INTRUSION DETECTION;

EID: 84866012853     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2339530.2339670     Document Type: Conference Paper

References (23)

1. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Watson. The Internet Motion Sensor: A Distributed Blackhole Monitoring System. In Proceedings of the Network And Distributed Security Symposium, San Diego, CA, January 2005.
2. P. Barford, R. Nowak, R. Willett, and V. Yegneswaran. Toward a Model for Sources of Internet Background Radiation. In Proceedings of the Passive and Active Measurement Conference, Adelaide, Australia, March 2006.
3. S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, J. Rowe, S. Staniford-Chen, R. Yip, and D. Zerkle. The Design of GrIDS: A Graph-Based Intrusion Detection System. UC Davis Technical Report CSE-99-2, 1999.
4. A. Clauset, MEJ Newman, and C. Moore. Finding community structure in very large networks. Physical Review E, 70(6):66111, 2004.
5. G. Cormode, F. Korn, S. Muthukrishnan, and Y. Wu. On signatures for communications graphs. In Proceedings of ICDE, Cancun, Mexico, April 2008.
6. W. de Nooy, A. Mrvar, and V. Batagelj. Exploratory Social Network Analysis with Pajek. Cambridge University Press, New York, 2005.
7. Benjamin H. Good, Yves A. de Montjoye, and Aaron Clauset. Performance of modularity maximization in practical contexts. Physical Review E, 81(4):046106+, April 2010.
8. Y. Jin, E. Sharafuddin, and Z. Zhang. Unveiling core network-wide communication patterns through application traffic activity graph decomposition. In Proceedings of ACM SIGMETRICS, Seattle, WA, June 2009.
9. Yu Jin, Jin Cao, Aiyou Chen, Tian Bu, and Zhi-Li Zhang. Identifying high cardinality Internet hosts. In Proceedings of IEEE INFOCOM, Rio de Janeiro, Brazil, April 2009.
10. J. Jung, V. Paxson, A. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004, Oakland, CA, May 2004.
11. N. Kamiyama, T. Mori, and R. Kawahara. Simple and adaptive identification of superspreaders by flow sampling. In Proceedings of IEEE INFOCOM, Anchorage, AK, April 2007.
12. KDD Cup data. http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html, August 1999.
13. Eric D. Kolaczyk. Statistical Analysis of Network Data: Methods and Models. Springer, New York, 2009.
14. P. McDaniel, S. Sen, O. Spatscheck, J. van der Merwe, B. Aiello, and C. Kalmanek. Enterprise security: A community of interest based approach. In Proceedings of NDSS, San Diego, CA, February 2006.
15. C. Noble and D. Cook. Graph-based anomaly detection. In Proceedings of SIGKDD, Washington, DC, August 2003.
16. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, (Special Issue on Intrusion Detection), 31(23-24):2435-2463, December 1999.
17. H. Ringberg, A. Soule, J. Rexford, and C. Diot. Sensitivity of pca for traffic anomaly detection. In Proceedings of ACM SIGMETRICS, San Diego, CA, June 2007.
18. M. Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of the Usenix LISA Conference, Seattle, WA, November 1999.
19. S. Rubin, S. Jha, and B. Miller. Automatic generation and analysis of nids attacks. In Proceedings of Annual Computer Security Applications Conference (ACSAC), Tucson, AZ, December 2004.
20. J. Sun, H. Qu, D. Chakrabarti, and C. Faloutsos. Relevance search and anomaly detection in bipartite graphs. Proceedings of SIGKDD Explorations Special Issue on Link Mining, 7(2), 2005.
21. J. Tolle and O. Niggemann. Supporting Intrusion Detection by Graph Clustering and Graph Drawing. In Proceedings of the Symposium on Recent Advances in Intrusion Detection, Toulouse, France, October 2000.
22. J. Ullrich. The Dshield Project. http://www.sans.org, 2010.
23. V. Yegneswaran, P. Barford, and J. Ullrich. Internet Intrusions: Global Characteristics and Prevalence. In Proceedings of ACM SIGMETRICS, San Diego, CA, June 2003.