Finding the vocabulary of program behavior data for anomaly detection

Proceedings - DARPA Information Survivability Conference and Exposition, DISCEX 2003

Volumn 1, Issue , 2003, Pages 152-163

  Michael, C C ^a  

^a Cigital   (United States)

Author keywords

Data analysis; Detectors; Filtering; Information analysis; Information systems; Intrusion detection; Monitoring; Object detection; Performance analysis; Vocabulary

Indexed keywords

DATA REDUCTION; DETECTORS; DISTRIBUTED COMPUTER SYSTEMS; FILTRATION; INFORMATION ANALYSIS; INFORMATION SYSTEMS; INTRUSION DETECTION; MERCURY (METAL); MONITORING; OBJECT DETECTION;

ANOMALY DETECTION; ANOMALY DETECTION SYSTEMS; ANOMALY DETECTOR; APPLICATION BEHAVIORS; PERFORMANCE ANALYSIS; PREPROCESSING TECHNIQUES; PROGRAM BEHAVIOR; VOCABULARY;

INFORMATION FILTERING;

EID: 84942248748     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DISCEX.2003.1194881     Document Type: Conference Paper

References (27)

1. Mit lincoln labs. 1999 darpa intrusion detection evaluation, http://www.ll.mit.edu/ist/ideval/index.html.
2. A. V. Aho and J. D. Ullman. Principles of Compiler Design. Addison-Wesley, 1977.
3. J. Anderson. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., Fort Washington, PA, April 1980.
4. J. Cannady. Artificial neural networks for misuse detection. In Proceedings of the 1998 National Information Systems Security Conf erence (NISSC'98), pages 443-456, October 5-8 1998. Arlington, VA.
5. P. D'haeseleer, S. Forrest, and P. Helman. An immunological approach to change detection: Algorithms, analysis an d implications. In IEEE Symposium on Security and Privacy, 1996.
6. D. Endler. Intrusion detection: Applying machine learning to solaris audit data. In Proceedings of the 1998 Annual Computer Security Applications Conference (ACSAC'98), pages 268-279, Los Alamitos, CA, December 1998. IEEE Computer Society, IEEE Computer Society Press. Scottsdale, AZ.
7. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for Unix processes. In Proceedinges of the 1996 IEEE Symposium on Research in Security and Privacy, pages 120-128. IEEE Computer Society, IEEE Computer Society Press, May 1996.
8. A. Ghosh, J. Wanken, and F. Charron. Detecting anomalous and unknown intrusions against programs. In Proceedings of the 1998 Annual Computer Security Applications Conference (ACSAC'98), December 1998.
9. D. Gusfield. Algorithms on Strings, Trees, and Sequences. Cambridge University Press, Cambridge, Mass., 1997.
10. D. Gusfield and J. Stoye. Linear time algorithms for finding and representing all the tandem repeats in a string, 1998.
11. J. Knight, D. Gusfield, and J. Stoye. The strmat software-package, http://www.cs.ucdavis.edu/ gusfield/strmat.tar.gz, 1998.
12. T. Lane and C. Brodley. An application of machine learning to anomaly detection. In Proceedings of the 20th National Information Systems Security Conf erence, pages 366-377, October 1997.
13. W. Lee et al. Learning patterns from Unix process execution traces for intrusion det ection. In Proceedings of AAAI97 Workshop on AI Methods in Fraud and Risk Management, 1997.
14. W. Lee and D. Xiang. Information-theoretic measures for anomaly detection. In Proceedings of the 2001 IEEE Symposium on Security and Privacy, 2001.
15. T. Lunt. Ides: an intelligent system for detecting intruders. In Proceedings of the Symposium: Computer Security, Threat and Count ermeasures, November 1990. Rome, Italy.
16. T. Lunt. A survey of intrusion detection techniques. Computers and Security, 12:405-418, 1993.
17. T. Lunt and R. Jagannathan. A prototype real-time intrusion-detection system. In Proceedings of the 1988 IEEE Symposium on Security and Privacy, April 1988.
18. T. Lunt, A. Tamaru, F. Gilham, R. Jagannthan, C. Jalali, H. Javitz, A. Valdos, P. Neumann, and T. Garvey. A real-time intrusion-detection expert system (ides). Technical Report, Computer Science Laboratory, SRI Internationnal, February 1992.
19. C. Marceau. Characterizing the behavior of a program using multiple-length N-grams. In Proceedings of the 2000 new security paradigm workshop, pages 101-110, 2000.
20. E. M. McCreight. A space-economic suffix tree construction algorithm. Jrnl. A.C.M., 23(2):262-272, Apr. 1976.
21. C. C. Michael and G. E. McGraw. Generating software test data by evolution. IEEE TSE, 27(9):1085-1110, 2001.
22. P. Porras and P. Neumann. Emerald: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the 20th National Information Systems Security Conference, pages 353-365, October 1997.
23. R. Sekar, M. Bendre, D. Dhurjati, and P. Bollineni. A fast automaton-based method for detecting anomalous program behaviors. In Proc. 2000 IEEE Symposium on Security and Privacy, pages 144-155. IEEE Computer Society, 2000.
24. J. Stoye and D. Gusfield. Simple and flexible detection of contiguous repeats using a suffix tree. In Proc. 9th Annual Conference on Combinatorial Pattern Matching, volume 1448 of Lecture Notes in Computer Science, pages 140-152. Springer-verlag, 1998.
25. K. M. C. Tan and R. A. Maxion. Why 6? defining the operational limits of stide, an anomaly-based intrusion detector. In IEEE Symposium on Security and Privacy, pages 12-15, 2002.
26. E. Ukkonen. Constructing suffixtreeson-lineinlineartime. In J. van Leeuwen, editor, Proceedings of the IFIP 12th World Computer Congress. Volume 1: Algorithms, Software, Architecture, pages 484-492, Amsterdam, The Netherlands, Sept. 1992. Elsevier Science Publishers.
27. P. Weiner. Linear pattern matching algorithms. In Conference Record, IEEE 14th Annual Symposium on Switching and Automata Theory, pages 1-11, 1973.