Security analysis of online centroid anomaly detection

Journal of Machine Learning Research

Volumn 13, Issue , 2012, Pages 3681-3724

  Kloft, Marius ^a   Laskov, Pavel ^b  

^a TECHNISCHE UNIVERSITÄT BERLIN   (Germany)

^b UNIVERSITY OF TÜBINGEN   (Germany)

Author keywords

Adversarial; Anomaly detection; Computer security; Network intrusion detection; Security analysis; Support vector data description

Indexed keywords

ADVERSARIAL; ANOMALY DETECTION; NETWORK INTRUSION DETECTION; SECURITY ANALYSIS; SUPPORT VECTOR DATA DESCRIPTION;

DATA DESCRIPTION; DATA HANDLING; INTRUSION DETECTION; LEARNING ALGORITHMS; SECURITY OF DATA;

SECURITY SYSTEMS;

EID: 84873445143     PISSN: 15324435     EISSN: 15337928     Source Type: Journal    
DOI: None     Document Type: Article

References (70)

1. D. Angluin and P. Laird. Learning from noisy examples. Machine Learning, 2(4):434-470, 1988.
2. P. Auer. Learning nested differences in the presence of malicious noise. Theoretical Computer Science, 185(1):159-175, 1997. (Pubitemid 127452836)
3. M. Bailey, J. Oberheide, J. Andersen, Z. M. Mao, F. Jahanian, and J. Nazario. Automated classification and analysis of internet malware. In Recent Adances in Intrusion Detection (RAID), pages 178-197, 2007.
4. M. Barreno, B. Nelson, R. Sears, A. Joseph, and J. Tygar. Can machine learning be securě In ACM Symposium on Information, Computer and Communication Security, pages 16-25, 2006.
5. M. Barreno, P. L. Bartlett, F. J. Chi, A. D. Joseph, B. Nelson, B. I. Rubinstein, U. Saini, and J. D. Tygar. Open problems in the security of learning. In AISec '08: Proceedings of the 1st ACM workshop on Workshop on AISec, pages 19-26, New York, NY, USA, 2008. ACM.
6. M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar. The security of machine learning. Machine Learning, 81(2):121-148, 2010.
7. B. Boser, I. Guyon, and V. Vapnik. A training algorithm for optimal margin classifiers. In D. Haussler, editor, Proceedings of the 5th Annual ACM Workshop on Computational Learning Theory, pages 144-152, 1992. (Pubitemid 23615470)
8. M. L. Braun, J. Buhmann, and K.-R. M̌uller. On relevant dimensions in kernel feature spaces. Journal of Machine Learning Research, 9:1875-1908, Aug 2008.
9. N. H. Bschouty, N. Eiron, and E. Kushilevitz. PAC learning with nasty noise. In Algorithmic Learning Theory (ALT 1999), pages 206-218, 1999.
10. G. Cretu, A. Stavrou, M. Locasto, S. Stolfo, and A. Keromytis. Casting out demons: Sanitizing training data for anomaly sensors. In Proc. of IEEE Symposium on Security and Privacy, pages 81-95, 2008.
11. G. F. Cretu-Ciocarlie, A. Stavrou, M. E. Locasto, and S. J. Stolfo. Adaptive anomaly detection via self-calibration and dynamic updating. In Recent Adances in Intrusion Detection (RAID), pages 41-60, 2009.
12. N. Dalvi, P. Domingos, M. Sumit, and S. D. Verma. Adversarial classification. In In KDD, pages 99-108. ACM Press, 2004.
13. O. Dekel and O. Shamir. Learning to classify with missing and corrupted features. In International Conference on Machine Learning (ICML), pages 216-223, 2008.
14. O. Dekel, O. Shamir, and L. Xiao. Learning to classify with missing and corrupted features. Machine Learning, 2009.
15. P. Fogla and W. Lee. Evading network anomaly detection systems: formal reasoning and practical techniques. In ACM Conference on Computer and Communications Security, pages 59-68, 2006. (Pubitemid 47131356)
16. P. Fogla, M. Sharif, R. Perdisci, O. Kolesnikov, andW. Lee. Polymorphic blending attacks. In Proc. of USENIX Security Symposium, pages 241-256, 2006.
17. S. Forrest, S. Hofmeyr, A. Somayaji, and T. Longstaff. A sense of self for unix processes. In Proc. of IEEE Symposium on Security and Privacy, pages 120-128, Oakland, CA, USA, 1996.
18. A. Globerson and S. Roweis. Nightmare at test time: Robust learning by feature deletion. In International Conference on Machine Learning (ICML), pages 353-360, 2006.
19. S. Hofmeyr, S. Forrest, and A. Somayaji. Intrusion detection using sequences of system calls. Journal of Computer Security, 6(3):151-180, 1998.
20. M. Kearns and M. Li. Learning in the presence of malicious errors. SIAM Journal on Computing, 22(4):807-837, 1993. (Pubitemid 23677152)
21. P. Laskov and M. Kloft. A framework for quantitative security analysis of machine learning. In D. Balfanz and J. Staddon, editors, AISec, pages 1-4. ACM, 2009. ISBN 978-1-60558-781-3.
22. P. Laskov, C. Scȟafer, and I. Kotenko. Intrusion detection in unlabeled data with quarter-sphere support vector machines. In Detection of Intrusions and Malware, and Vulnerability Assessment, Proc. of DIMVA Conference, pages 71-82, 2004a.
23. P. Laskov, C. Scȟafer, I. Kotenko, and K.-R. M̌uller. Intrusion detection in unlabeled data with quarter-sphere support vector machines (extended version). Praxis der Informationsverarbeitung und Kommunikation, 27:228-236, 2004b.
24. P. Laskov, C. Gehl, S. Kr ̌uger, and K. R. M̌uller. Incremental support vector learning: Analysis, implementation and applications. Journal of Machine Learning Research, 7:1909-1936, Sept. 2006. (Pubitemid 44477117)
25. A. Lazarevic, L. Ertoz, V. Kumar, A. Ozgur, and J. Srivastava. A comparative study of anomaly detection schemes in network intrusion detection. In Proc. of SIAM International Conference on Data Mining (SDM), 2003.
26. C. Leslie, E. Eskin, and W. Noble. The spectrum kernel: A string kernel for SVM protein classification. In Proc. Pacific Symp. Biocomputing, pages 564-575, 2002.
27. Z. Li, M. Sandhi, Y. Chen, M.-Y. Kao, and B. Chavez. Hamsa: fast signature generation for zeroday polymorphic worms with provable attack resilience. In IEEE Security and Privacy, pages 32-47, 2006.
28. N. Littlestone. Learning quickly when irrelevant attributes abound: A new linear threshold algorithm. Machine Learning, 2:285-318, 1988.
29. D. Lowd and C.Meek. Good word attacks on statistical spam filters. In Proceedings of the 11th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 641-647, 2005a.
30. D. Lowd and C. Meek. Adversarial learning. In Conference on Email and Anti-Spam, 2005b.
31. M. Markou and S. Singh. Novelty detection: a review - part 1: statistical approaches. Signal Processing, 83:2481-2497, 2003a.
32. M. Markou and S. Singh. Novelty detection: a review - part 2: neural network based approaches. Signal Processing, 83:2499-2521, 2003b.
33. L. Martein and S. Schaible. On solving a linear program with one quadratic constraint. Decisions in Economics and Finance, 10:75-90, 2005.
34. Microsoft. Microsoft security intelligence report: January to June 2008. Microsoft Corporation, 2008.
35. M.Mohri and A. Rostamizadeh. Stability bounds for stationary φ-mixing and β-mixing processes. J. Mach. Learn. Res., 11:789-814, March 2010. ISSN 1532-4435. URL http: //portal.acm.org/citation. cfmid=1756006.1756032.
36. D. Moore, C. Shannon, and J. Brown. Code-Red: a case study on the spread and victims of an internet worm. In Proc. of Internet Measurement Workshop (IMW), pages 273-284, 2002.
37. K.-R. M̌uller, S. Mika, G. Řatsch, K. Tsuda, and B. Scȟolkopf. An introduction to kernel-based learning algorithms. IEEE Neural Networks, 12(2):181-201, May 2001. (Pubitemid 32371478)
38. A. Nairac, T. N., R. Carr, S. King, P. Cowley, and L. Tarassenko. A system for the analysis fo jet vibration data. Integrated Computer-Aided Engineering, 1999.
39. B. Nelson and A. D. Joseph. Bounding an attack's complexity for a simple learning model. In Proc. of the First Workshop on Tackling Computer Systems Problems with Machine Learning Techniques (SysML), Saint-Malo, France, 2006.
40. B. Nelson, M. Barreno, F. Chi, A. Joseph, B. Rubinstein, U. Saini, C. Sutton, J. Tygar, and K. Xia. Exploiting machine learning to subvert your spam filter. In Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET'08), 2008.
41. J. Newsome, B. Karp, and D. Song. Paragraph: Thwarting signature learning by training maliciously. In Recent Adances in Intrusion Detection (RAID), pages 81-105, 2006. (Pubitemid 44617848)
42. E. Parzen. On estimation of probability density function and mode. Annals of Mathematical Statistics, 33:1065-1076, 1962.
43. R. Perdisci, D. Dagon, W. Lee, P. Fogla, and M. Sharif. Misleading worm signature generators using deliberate noise injection. In Proc. of IEEE Symposium on Security and Privacy, pages 17-31, 2006. (Pubitemid 44753709)
44. W. Polonik. Measuring mass concentration and estimating density contour clusters - an excess mass approach. Annals of Statistics, 23:855-881, 1995.
45. S. Rajasegarar, C. Leckie,M. Palaniswami, and J. Bezdek. Quarter sphere based distributed anomaly detection in wireless sensor networks. In IEEE International Conference on Communications (ICC), pages 3864-3869, 2007. (Pubitemid 351146132)
46. K. Rieck and P. Laskov. Detecting unknown network attacks using language models. In Detection of Intrusions and Malware, and Vulnerability Assessment, Proc. of 3rd DIMVA Conference, LNCS, pages 74-90, July 2006. (Pubitemid 44124003)
47. K. Rieck and P. Laskov. Language models for detection of unknown attacks in network traffic. Journal in Computer Virology, 2(4):243-256, 2007.
48. K. Rieck and P. Laskov. Linear-time computation of similarity measures for sequential data. Journal of Machine Learning Research, 9(Jan):23-48, 2008.
49. K. Rieck, T. Holz, C. Willems, P. Ďussel, and P. Laskov. Learning and classification of malware behavior. In Detection of Intrusions and Malware, and Vulnerability Assessment, Proc. of 5th DIMVA Conference, LNCS, pages 108-125, 2008.
50. B. Scȟolkopf and A. Smola. Learning with Kernels. MIT Press, Cambridge, MA, 2002.
51. B. Scȟolkopf, A. Smola, and K.-R. M̌uller. Nonlinear component analysis as a kernel eigenvalue problem. Neural Computation, 10:1299-1319, 1998. (Pubitemid 128463674)
52. B. Scȟolkopf, J. Platt, J. Shawe-Taylor, A. Smola, and R. Williamson. Estimating the support of a high-dimensional distribution. Neural Computation, 13(7):1443-1471, 2001. (Pubitemid 33595028)
53. C. Shannon and D. Moore. The spread of the Witty worm. IEEE Security and Privacy, 2(4):46-50, 2004.
54. J. Shawe-Taylor and N. Cristianini. Kernel Methods for Pattern Analysis. Cambridge University Press, 2004.
55. Y. Song, M. Locasto, A. Stavrou, A. Keromytis, and S. Stolfo. On the infeasibility of modeling polymorphic shellcode. In Conference on Computer and Communications Security (CCS), pages 541-551, 2007.
56. I. Steinwart, D. Hush, and C. Scovel. A classification framework for anomaly detection. Journal of Machine Learning Research, 6:211-232, 2005.
57. I. Steinwart, D. Hush, and C. Scovel. Learning from dependent observations. J. Multivar. Anal., 100:175-194, January 2009. ISSN 0047-259X.
58. M. Sugiyama, M. Krauledat, and K.-R. M̌uller. Covariate shift adaptation by importance weighted cross validation. Journal of Machine Learning Research, 8:1027-1061, 2007.
59. Symantec. Symantex report on the underground economy: July 07 to June 08. Symantec Corporation, 2008.
60. D. Tax and R. Duin. Data domain description by support vectors. In M. Verleysen, editor, Proc. ESANN, pages 251-256, Brussels, 1999a. D. Facto Press.
61. D. Tax and R. Duin. Support vector domain description. Pattern Recognition Letters, 20(11-13): 1191-1199, 1999b. (Pubitemid 32261897)
62. A. Tsybakov. On nonparametric estimation of density level sets. Annals of Statistics, 25:948-969, 1997.
63. C. van de Panne. Programming with a quadratic constraint. Management Science, 12:798-815, 1966.
64. V. Vapnik. Statistical Learning Theory. Wiley, New York, 1998.
65. R. Vert and J.-P. Vert. Consistency and convergence rates of one-class svms and related algorithms. J. Mach. Learn. Res., 7:789-814, December 2006. ISSN 1532-4435.
66. K. Wang and S. Stolfo. Anomalous payload-based network intrusion detection. In Recent Adances in Intrusion Detection (RAID), pages 203-222, 2004. (Pubitemid 39741895)
67. K. Wang, G. Cretu, and S. Stolfo. Anomalous payload-based worm detection and signature generation. In Recent Adances in Intrusion Detection (RAID), 2005.
68. K. Wang, J. Parekh, and S. Stolfo. Anagram: A content anomaly detector resistant to mimicry attack. In Recent Adances in Intrusion Detection (RAID), pages 226-248, 2006. (Pubitemid 44617855)
69. C. Warrender, S. Forrest, and B. Pearlmutter. Detecting intrusions using system calls: alternative data methods. In Proc. of IEEE Symposium on Security and Privacy, pages 133-145, 1999.
70. D.-Y. Yeung and C. Chow. Parzen-window network intrusion detectors. In Sixteenth International Conference on Pattern Recognition (ICPR), pages 385-388, 2002. (Pubitemid 44851023)