Toward supervised anomaly detection

Journal of Artificial Intelligence Research

Volumn 46, Issue , 2013, Pages 235-262

  Görnitz, Nico ^a,b   Kloft, Marius ^a,b   Rieck, Konrad ^c   Brefeld, Ulf ^d,e  

^a TECHNISCHE UNIVERSITÄT BERLIN   (Germany)

^b MEMORIAL SLOAN KETTERING CANCER CENTER   (United States)

^c UNIVERSITY OF GÖTTINGEN   (Germany)

^d DARMSTADT UNIVERSITY OF TECHNOLOGY   (Germany)

^e GERMAN INSTITUTE FOR INTERNATIONAL EDUCATIONAL RESEARCH   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

INTRUSION DETECTION; MACHINE LEARNING; UNSUPERVISED LEARNING;

ACTIVE LEARNING STRATEGIES; DETECTION ACCURACY; EMPIRICAL STUDIES; NETWORK INTRUSION DETECTION; OPTIMIZATION PROBLEMS; PREDICTIVE PERFORMANCE; SUPERVISED CLASSIFIERS; UNSUPERVISED ANOMALY DETECTION;

ANOMALY DETECTION;

EID: 84875512265     PISSN: None     EISSN: 10769757     Source Type: Journal    
DOI: 10.1613/jair.3623     Document Type: Article

References (62)

1. Almgren, M., & Jonsson, E. (2004). Using active learning in intrusion detection. In Proc. of IEEE Computer Security Foundation Workshop, pp. 88-89.
2. Andrews, D. F., & Pregibon, D. (1978). Finding the outliers that matter. Journal of the Royal Statistical Society. Series B (Methodological), 40(1), 85-93. /
3. Blanchard, G., Lee, G., & Scott, C. (2010). Semi-Supervised Novelty Detection. Journal of Machine Learning Research," 2973-2973-3009-3009.
4. Blum, A., & Mitchell, T. (1998). Combining labeled and unlabeled data with co-training. In COLT' 98: Proc. of the eleventh annual conference on Computational learning theory, pp. 92-100, New York, NY, USA. ACM.
5. Boser, B., Guyon, I., & Vapnik, V. (1992). A training algorithm for optimal margin classifiers. In Haussler, D. (Ed.), Proceedings of the 5th Annual ACM Workshop on Computational Learning Theory, pp. 144-152.
6. Campbell, C, & Bennett, K. (2001). A linear programming approach to novelty detection. In Leen, T., Dietterich, T., & Tresp, V. (Eds.), Advances in Neural Information Processing Systems, Vol. 13, pp. 395-401. MIT Press.
7. Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3), 1-58.
8. Chapelle, O., Chi, M., & Zien, A. (2006). A continuation method for semi-supervised SVMs. In ICML, pp. 185-192, New York, New York, USA. ACM.
9. Chapelle, O., & Zien, A. (2005). Semi-supervised classification by low density separation. In Proc. of the International Workshop on AI and Statistics.
10. Chapelle, O., Schölkopf, B., & Zien, A. (2006). Semi-Supervised Learning (Adaptive Computation and Machine Learning). MIT Press.
11. Cortes, C, & Vapnik, V. (1995). Support vector networks. Machine Learning, 20, 273-297.
12. Do, T.-M.-T. (2010). Regularized bundle methods for large-scale learning problems with an application to large margin training of hidden Markov models. Ph.D. thesis, Pierre and Marie Curie University Paris.
13. Eskin, E., Arnold, A., Prerau, M., Portnoy, L., & Stolfo, S. (2002). Applications of Data Mining in Computer Security, chap. A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data. Kluwer.
14. Fogla, P., Sharif, M., Perdisci, R., Kolesnikov, O., & Lee, W. (2006). Polymorphic blending attacks. In Proc. of USENIX Security Symposium.
15. Goh, K.-S., Chang, E. Y, & Li, B. (2005). Using one-class and two-class svms for multiclass image annotation. IEEE Transactions on Knowledge and Data Engineering, 17, 1333-1346.
16. Görnitz, N., Kloft, M., & Brefeld, U. (2009). Active and semi-supervised data domain description. In ECML/PKDD (1), pp. 407-422.
17. Heller, K., Svore, K., Keromytis, A., & Stolfo, S. (2003). One class support vector machines for detecting anomalous windows registry accesses. In Proc. of the workshop on Data Mining for Computer Security.
18. Hoi, C.-H., Chan, C.-H., Huang, K., Lyu, M., & King, I. (2003). Support vector machines for class representation and discrimination. In Proc. of the International Joint Conference on Neural Networks.
19. Huber, P. (1972). Robust statistics: a review. Ann. Statist., 43, 1041.
20. Joachims, T. (1999). Transductive inference for text classification using support vector machines. In International Conference on Machine Learning (ICML), pp. 200-209, Bled, Slowenien.
21. p-norm multiple kernel learning. Journal of Machine Learning Research, 12, 953-997.
22. Kruegel, C, Vigna, G., & Robertson, W. (2005). A multi-model approach to the detection of web-based attacks. Computer Networks, 48(5).
23. Krueger, T., Gehl, C, Rieck, K., & Laskov, P. (2010). TokDoc: A self-healing web application firewall. In Proc. of 25th ACM Symposium on Applied Computing (SAC), pp. 1846-1853.
24. Lai, C., Tax, D. M. J., Duin, R. P. W., Zbieta, E., Ekalska, P., & Ik, P. P. (2004). A study on combining image representations for image classification and retrieval. International Journal of Pattern Recognition and Artificial Intelligence, 18, 867-890.
25. Li, X.-l., & Liu, B. (2005). Learning from Positive and Unlabeled Examples with Different Data Distributions. In ECML.
26. Liu, B., Dai, Y., Li, X., Lee, W. S., & Yu, P. S. (2003). Building Text Classifiers Using Positive and Unlabeled Examples. In IEEE International Conference on Data Mining, pp. 179-186. IEEE Comput. Soc.
27. Liu, Y., & Zheng, Y. F. (2006). Minimum enclosing and maximum excluding machine for pattern description and discrimination. In ICPR '06: Proc. of the 18th International Conference on Pattern Recognition, pp. 129-132, Washington, DC, USA. IEEE Computer Society.
28. Muñoz Marí, J., Bovolo, F., Gómez-Chova, L., Bruzzone, L., & Camp-Valls, G. (2010). Semi-Supervised One-Class Support Vector Machines for Classification of Remote Sensing Data. IEEE Transactions on Geoscience and Remote Sensing, 48(8), 3188-3197.
29. Manevitz, L. M., & Yousef, M. (2002). One-class svms for document classification. J. Mach. Learn. Res., 2, 139-154.
30. Mao, C.-H., Lee, H.-M., Parikh, D., Chen, T., & Huang, S.-Y. (2009). Semi-supervised co-training and active learning based approach for multi-view intrusion detection. In SAC '09: Proc. of the 2009 ACM symposium on Applied Computing, pp. 2042-2048, New York, NY, USA. ACM.
31. Markou, M., & Singh, S. (2003a). Novelty detection: a review - part 1: statistical approaches. Signal Processing, 83, 2481-2497.
32. Markou, M., & Singh, S. (2003b). Novelty detection: a review - part 2: neural network based approaches. Signal Processing, 83, 2499-2521.
33. Maynor, K., Mookhey, K., Cervini, J. F. R., & Beaver, K. (2007). Metasploit Toolkit. Syngress.
34. Müller, K.-R., Mika, S., Rätsch, G., Tsuda, K., & Schölkopf, B. (2001). An introduction to kernelbased learning algorithms. IEEE Neural Networks, 12(2), 181-201.
35. Onoda, T., Murata, H., & Yamada, S. (2006). One class classification methods based non-relevance feedback document retrieval. In WI-IATW '06: Proc. of the 2006 IEEE/WIC/ACM international conference on Web Intelligence and Intelligent Agent Technology, pp. 393-396, Washington, DC, USA. IEEE Computer Society.
36. Park, J., Kang, D., Kim, J., Kwok, J. T., & Tsang, I. W. (2007). SVDD-based pattern denoising. Neural Computation, 19, 1919-1938.
37. Paxson, V. (1999). Bro: A System for Detecting Network Intruders in Real-Time. Elsevier Computer Networks, 31(23-24), 2435-2463.
38. Pelleg, D., & Moore, A. (2004). Active learning for anomaly and rare-category detection. In Proc. Advances in Neural Information Processing Systems, pp. 1073-1080.
39. Perdisci, R., Ariu, D., Fogla, P., Giacinto, G., & Lee, W. (2009). McPAD: A multiple classifier system for accurate payload-based anomaly detection. Computer Networks, 5(6), 864-881.
40. Rieck, K. (2009). Machine Learning for Application-Layer Intrusion Detection. Ph.D. thesis, Berlin Institute of Technology (TU Berlin).
41. Rieck, K., & Laskov, P. (2006). Detecting unknown network attacks using language models. In Detection of Intrusions and Malware, and Vulnerability Assessment, Proc. of 3rd DIMVA Conference, LNCS, pp. 74-90.
42. Rieck, K., & Laskov, P. (2007). Language models for detection of unknown attacks in network traffic. Journal in Computer Virology, 2(4), 243-256.
43. Rieck, K., & Laskov, P. (2008). Linear-time computation of similarity measures for sequential data. Journal of Machine Learning Research, 9(Jan), 23-48.
44. Rifkin, R. M., & Lippert, R. A. (2007). Value regularization and fenchel duality. Journal of Machine Learning Research, 8, 441-479.
45. Roesch, M. (1999). Snort: Lightweight intrusion detection for networks. In Proc. of USENIX Large Installation System Administration Conference LISA, pp. 229-238.
46. Salton, G., Wong, A., & Yang, C. (1975). A vector space model for automatic indexing. Communications of the ACM, 18(11), 613-620.
47. Schölkopf, B., & Smola, A. (2002). Learning with Kernels. MIT Press, Cambridge, MA.
48. Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001). Estimating the support of a high-dimensional distribution. Neural Computation, 13(7), 1443-1471.
49. Shawe-Taylor, J., & Cristianini, N. (2004). Kernel methods for pattern analysis. Cambridge University Press.
50. Sindhwani, V., Niyogi, P., & Belkin, M. (2005). Beyond the point cloud: from transductive to semi-supervised learning. In ICML, Vol. 1, pp. 824-831. ACM.
51. Sonnenburg, S. (2008). Machine Learning for Genomic Sequence Analysis. Ph.D. thesis, Fraunhofer Institute FIRST. supervised by K.-R. Müller and G. Rätsch.
52. Stokes, J. W., & Platt, J. C. (2008). Aladin: Active learning of anomalies to detect intrusion. Tech. rep., Microsoft Research.
53. Stolfo, S. J., Apap, F., Eskin, E., Heller, K., Hershkop, S., Honig, A., & Svore, K. (2005). A comparative evaluation of two algorithms for windows registry anomaly detection. In Journal of Computer Security, pp. 659-693.
54. Tax, D. M. J. (2001). One-class classification. Ph.D. thesis, Technical University Delft.
55. Tax, D. M. J., & Duin, R. P. W. (2004). Support vector data description. Machine Learning, 54, 45-66.
56. Tong, S., & Koller, D. (2000). Support vector machine active learning with applications to text classification. In Proc. of the Seventeenth International Conference on Machine Learning, San Francisco, CA. Morgan Kaufmann.
57. Vapnik, V. (1998). Statistical Learning Theory. Wiley, New York.
58. Wang, J., Neskovic, P., & Cooper, L. N. (2005). Pattern classification via single spheres. In Computer Science: Discovery Science (DS), Vol. 3735, pp. 241-252.
59. Wang, K., Parekh, J., & Stolfo, S. (2006). Anagram: A content anomaly detector resistant to mimicry attack. In Recent Adances in Intrusion Detection (RAID), pp. 226-248.
60. Warmuth, M. K., Liao, J., Rätsch, G., Mathieson, M., Putta, S., & Lemmen, C. (2003). Active learning with support vector machines in the drug discovery process. Journal of Chemical Information and Computer Sciences, 43(2), 667-673.
61. Yuan, C., & Casasent, D. (2004). Pseudo relevance feedback with biased support vector machine. In Proc. of the International Joint Conference on Neural Networks.
62. Zhang, D., & Lee, W. S. (2005). A simple probabilistic approach to learning from positive and unlabeled examples. In Proceedings of the 5th Annual UK Workshop on⋯.