Applications of hidden Markov models to detecting multi-stage network attacks

Proceedings of the 36th Annual Hawaii International Conference on System Sciences, HICSS 2003

Volumn , Issue , 2003, Pages 10-19

  Ourston, D ^a   Matzner, S ^a   Stump, W ^a   Hopkins, B ^a  

^a UNIVERSITY OF TEXAS AT AUSTIN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPLEX NETWORKS; COMPUTER CRIME; DECISION TREES; FORESTRY; INTRUSION DETECTION; LEARNING SYSTEMS; NEURAL NETWORKS; RANDOM FORESTS;

ACTION SEQUENCES; INTERNET ATTACKS; INTRUSION DETECTION SYSTEMS; MACHINE LEARNING TECHNIQUES; MULTI STAGE; MULTI-STEP ATTACKS; NETWORK ATTACK; RESEARCH RESULTS;

HIDDEN MARKOV MODELS;

EID: 84969506768     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2003.1174909     Document Type: Conference Paper

References (30)

1. Ourston, D., Matzner, S., Stump, W., Hopkins, B., Richards, K. Identifying Coordinated Internet Attacks. In: Proceedings of the Second SSGRR Conference. Rome, Italy (2001)
2. Valdes, A., Skinner, K.: Probabilistic Alert Correlation. In: The Proceedings of Recent Advances in Intrusion Detection (RAID). Springer Verlag Lecture Notes in Computer Science (2001)
3. Lane, T., Brodley, C.: Temporal Sequence Learning for Anomaly Detection. In: 5th ACM Conference on Computer & Communications Security. San Francisco, California, USA (1998) 150-158
4. Aha, D.W., Kibler, D., Albert, M.K.: Instance-Based Learning Algorithms, Machine Learning 6 (1991) 37-66
5. Manganaris, S., et al.: A Data Mining Analysis of RTID Alarms. In: 2nd International Workshop on Recent Advances in Intrusion Detection. Purdue University, West Lafayette, Indiana, USA (1999)
6. Rabiner, L.R., Juang, B.H.: An Introduction to Hidden Markov Models. In: IEEE ASSP Magazine, 1986
7. Warrender, C., Forrest S., and Pearlmutter, B.: Detecting Intrusions Using System Calls: Alternative Data Models. In: Proceedings of the 1999 IEEE Symposium on Security and Privacy. (1999)
8. Huang, X.D., Ariki, Y., Jack, M.A.: Hidden Markov Models for Speech Recognition, Edinburgh University Press (1990)
9. Wen, Y.: Text Mining Using HMM and PPM. Master's thesis. Department of Computer Science, University of Waikato (2001)
10. Bunke, H., Caelli, T. (eds.): Hidden Markov Models: Applications in Computer Vision. World Scientific, Series in Machine Perception and Artificial Intelligence, Vol. 45. (2001)
11. Boys, R.J., Henderson, D.A., Wilkinson, D.J.: Detecting Homogeneous Segments in DNA Sequences by Using Hidden Markov Models. Applied Statistics 49(2) (2000) 269
12. Green, J., Marchette, D., Northcutt, S., and Ralph, B.: Analysis Techniques for Detecting Coordinated Attacks and Probes. In: Proceedings of the 1st USENIX Workshop on Intrusion Detection and Network Monitoring (1999)
13. Cuppens, F.: Managing Alerts in a Multi-intrusion Detection Environment. In: 17th Annual Computer Security Applications Conference. New Orleans, Louisiana (2001)
14. Bloedorn, E., et al.: Data Mining for Network Intrusion Detection: How to Get Started. Mitre Corporation. http://www.mitre.org/support/papers/tech-papers-01/bloedorn-datamining/index.shtml (2001)
15. Sinclair, C., Pierce L., Matzner, S.: An Application of Machine Learning Techniques to Network Intrusion Detection. Proceedings of the 15th Annual Computer Security Applications Conference (1999)
16. nd edn. Addison Wesley Longman
17. Witten, I.H., Eibe, F.: Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations. Morgan Kaufmann (2000) Ch. 8. http://www.cs.waikato.ac.nz/ml/weka/
18. Yoon, H.: HmmLib: Hidden Markov Model Library in Java. http://www.vilab.com/hmmlib/home.html
19. Townsend, J.T.: Theoretical Analysis of an Alphabetic Confusion Matrix. Perception and Psychophysics 9(1A) (1971) 40-50
20. Manning, C., Schutze, H: Foundations of Statistical Natural Language Processing. The MIT Press, Cambridge, Massachusetts, USA 267-270
21. Egan, J.P.: Signal Detection Theory and ROC Analysis. Series in Cognition and Perception. Academic Press, New York (1975)
22. Agarwal, R., Joshi, M.: PNrule: A New Framework for Learning Classifier Models in Data Mining (A Case-Study in Network Intrusion Detection). Technical Report TR 00-015, Department of Computer Science, University of Minnesota, USA (2000)
23. Provost, F., Fawcett, T.: Robust Classification for Imprecise Environments. Machine Learning 42 (2001) 203-231
24. Freitag, D., Kushmerick, N.: Boosted Wrapper Induction. In: Proceedings of the Seventeenth National Conference on Artificial Intelligence. Austin, Texas, USA (2000)
25. Japkowicz, N.: Learning from Imbalanced Data Sets: A Comparison of Various Strategies. In: Papers from the AAAI Workshop on Learning from Imbalanced Data Sets. Technical Report WS-00-05, AAAI Press, Menlo Park, California, USA (2000)
26. Joshi, M. Agarwal, R., Kumar, V.: Mining Needles in a Haystack: Classifying Rare Classes via Two-Phase Rule Induction. In: Proceedings of ACM SIGMOD'01 Conference on Management of Data. Santa Barbara, California, USA (2001)
27. Hand, D., Till, R.: A Simple Generalization of the Area under the Roc Curve for Multiple Class Classification Problems. Machine Learning 45 (2001) 171-186
28. Eskin, E.: Anomaly Detection over Noisy Data Using Learned Probability Distributions. In: Proceedings of the Seventeenth International Conference on Machine Learning (ICML-2000) (2000)
29. Ourston, D.: Using Explanation-Based and Empirical Methods in Theory Revision. Ph.D. thesis. The University of Texas, Austin, Texas, USA (1991)
30. Mooney, R. J., Ourston, D.: Theory Refinement with Noisy Data. Technical Report AI91-153, Artificial Intelligence Laboratory. The University of Texas, Austin, Texas, USA (1991)