Context infusion in semantic link networks to detect cyber-attacks: A flow-based detection approach

Proceedings - 2014 IEEE International Conference on Semantic Computing, ICSC 2014

Volumn , Issue , 2014, Pages 175-182

  Aleroud, Ahmed ^a   Karabatis, George ^a  

^a Baltimore County   (United States)

Author keywords

context; contextual information; cyber security; Intrusion detection; network flows; semantic link networks

Indexed keywords

INTRUSION DETECTION; SEMANTICS;

CONTEXT; CONTEXTUAL INFORMATION; CYBER SECURITY; NETWORK FLOWS; SEMANTIC LINK NETWORK;

COMPUTER CRIME;

EID: 84906968815     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICSC.2014.29     Document Type: Conference Paper

References (25)

1. A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An Overview of IP Flow-Based Intrusion Detection," IEEE Communications Surveys & Tutorials, vol. 12, no. 3, pp. 343-356, 2010.
2. L. Constantin. (2010, 11/15/2013). Compromised Web Servers to Build Ssh Brute Force Botnet [online]. Available: http://news.softpedia.com/news/ Compromised-Web-Servers-Used-to-Build-SSH-Brute-Force-Botnet-151779.shtml
3. P. Winter, E. Hermann, and M. Zeilinger, "Inductive Intrusion Detection in Flow-Based Network Data Using One-Class Support Vector Machines," in 4th IFIP International Conference on New Technologies, Mobility and Security (NTMS'11), Dubai, UAE, 2011, pp. 1-5.
4. B. Claise. (2008, 24/11/2013). Specification of the Ip Flow Information Export (Ipfix) Protocol for the Exchange of Ip Traffic Flow Information. Available: http://www.ietf.org/rfc/rfc5101.txt
5. A. Wagner and B. Plattner, "Entropy Based Worm and Anomaly Detection in Fast IP Networks," in 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise., Modena, Italy, 2005, pp. 172-177.
6. F. Dressler, W. Jaegers, and R. German, "Flow-Based Worm Detection Using Correlated Honeypot Logs," in ITG-GI Conference on Communication in Distributed Systems(KiVS), 2007, pp. 1-6.
7. G. Gu, R. Perdisci, J. Zhang, and W. Lee, "Botminer: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection," in Proceedings of the 17th conference on Security(USENIX'08), San Jose, CA, 2008, pp. 139-154.
8. A. Sperotto, R. Sadre, P. Boer, and A. Pras, "Hidden Markov Model Modeling of Ssh Brute-Force Attacks," in Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management (DSOM '09), Venice, Italy, 2009, pp. 164-176.
9. A. Lakhina, M. Crovella, and C. Diot, "Mining Anomalies Using Traffic Feature Distributions," SIGCOMM Comput. Commun. Rev., vol. 35, no. 4, pp. 217-228, 2005.
10. Z. Hai, S. Yunchuan, and Z. Junsheng, "Schema Theory for Semantic Link Network," in Fourth International Conference on Semantics, Knowledge and Grid(SKG'08), Beijing, 2008, pp. 189-196.
11. G. Karabatis, Z. Chen, V. Janeja, T. Lobo, M. Advani, M. Lindvall, et al., "Using Semantic Networks and Context in Search for Relevant Software Engineering Artifacts," Journal on Data Semantics, LNCS 5880, vol. 14, no. pp. 74-104, 2009.
12. Z. Chen, A. Gangopadhyay, G. Karabatis, M. McGuire, and C. Welty, "Semantic Integration and Knowledge Discovery for Environmental Research," Journal of Database Management (JDM), vol. 18, no. 1, pp. 43-68, 2007.
13. H. Zhuge, "Communities and Emerging Semantics in Semantic Link Network: Discovery and Learning," IEEE Trans. on Knowl. and Data Eng., vol. 21, no. 6, pp. 785-799, 2009.
14. P. J. Brown, J. D. Bovey, and C. Xian, "Context-Aware Applications: From the Laboratory to the Marketplace," IEEE Personal Communications, vol. 4, no. 5, pp. 58-64, 1997.
15. A. Zimmermann, A. Lorenz, and R. Oppermann, "An Operational Definition of Context," in Proceedings of the 6th International and Interdisciplinary Conference on Modeling and Using Context (Context'07), Roskilde University, Denmark, 2007, pp. 558-571.
16. S. Noel, E. Robertson, and S. Jajodia, "Correlating Intrusion Events and Building Attack Scenarios through Attack Graph Distances," in 20th Annual Computer Security Applications Conference(CSAC'04), Tucson, AZ, USA, 2004, pp. 350-359.
17. T. M. Cover and J. A. Thomas, Elements of Information Theory, Chapter 2: Entropy, Relative Entropy and Mutual Information: John Wiley & Sons, 2012.
18. W. Qishi, D. Ferebee, L. Yunyue, and D. Dasgupta, "An Integrated Cyber Security Monitoring System Using Correlation-Based Techniques," in IEEE International Conference on System of Systems Engineering(SoSE'09), Albuquerque, NM, 2009, pp. 1-6.
19. J. Beauquier and Y. Hu, "Intrusion Detection Based on Distance Combination," in Proceedings of World Academy of Science: Engineering & Technolog(WASET), 2007, p. 172.
20. S. Boriah, V. Chandola, and V. Kumar, "Similarity Measures for Categorical Data: A Comparative Evaluation," in Proceedings of the eighth SIAM International Conference on Data Mining (SDM), Atlanta, Georgia, 2008, pp. 243-254.
21. J. W. Grzymala-Busse, "Selected Algorithms of Machine Learning from Examples," Fundamenta Informaticae, vol. 1, no. 8, pp. 193-207, 1993.
22. A. Sperotto, R. Sadre, F. Vliet, and A. Pras, "A Labeled Data Set for Flow-Based Intrusion Detection," in 9th IEEE International Workshop on IP Operations and Management((IPOM'09), Venice, Italy, 2009, pp. 39-50.
23. A. Shiravi, H. Shiravi, M. Tavallaee, and A. A. Ghorbani, "Toward Developing a Systematic Approach to Generate Benchmark Datasets for Intrusion Detection," Computers & Security, vol. 31, no. 3, pp. 357-374, 2012.
24. M. Tavallaee, E. Bagheri, W. Lu, and A.-A. Ghorbani, "A Detailed Analysis of the Kdd Cup 99 Data Set," in Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications(CISDA'09), Ottawa, ON, 2009.
25. C. Guo, Y.-J. Zhou, Y. Ping, S.-S. Luo, Y.-P. Lai, and Z.-K. Zhang, "Efficient Intrusion Detection Using Representative Instances," Computers & Security, vol. 39, no. p. 255, 2013.