Machine Learning Techniques for Passive Network Inventory

IEEE Transactions on Network and Service Management

Volumn 7, Issue 4, 2010, Pages 244-257

  Abdelnur, Humberto ^a   Festor, Olivier ^a   François, Jérôme ^b   State, Radu ^b  

^a INRIA   (France)

^b UNIVERSITY OF LUXEMBOURG   (Luxembourg)

Author keywords

Fingerprinting; inventory management; SVM; syntactic tree

Indexed keywords

EID: 85008065750     PISSN: 19324537     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNSM.2010.1012.0352     Document Type: Article

References (31)

1. J. D. Case, M. Fedor, M. L. Schoffstall, and J. Davin, “RFC: Simple Network Management Protocol (SNMP),” United States, 1990.
2. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, and E. Schooler, “RFC: SIP: Session Initiation Protocol,” United States, 2002.
3. H. Abdelnur, T. Avanesov, M. Rusinowitch, and R. State, “Abusing SIP authentication,” in Proc. IEEE Inf. Assurance Security (ISIAS), 2008, pp. 237–242.
4. L. Wang, editor, Support Vector Machines: Theory and Applications, ser. Studies in Fuzziness and Soft Computing. Springer, 2005, vol. 177.
5. L. Khan, M. Awad, and B. Thuraisingham “A new intrusion detection system using support vector machines and hierarchical clustering,” VLDB J., vol. 16, no. 4, pp. 507–521, 2007.
6. M. Nassar, R. State, and O. Festor, “Monitoring SIP traffic using support vector machines,” in Proc. 11th International Symp. Recent Advances Intrusion Detection, Lecture Notes Computer Science, vol. 5230. Springer, 2008, pp. 311–330.
7. R. Debnath, N. Takahide, and H. Takahashi “A decision based one-against-one method for multi-class support vector machine,” Pattern Anal. Appl., vol. 7, no. 2, pp. 164–175, 2004.
8. C.-W. Hsu and C.-J. Lin “A comparison of methods for multiclass support vector machines,” IEEE Trans. Neural Networks, vol. 13, no. 2, pp. 415–425, Mar. 2002.
9. N. Cristianini and J. Shawe-Taylor, An Introduction to Support Vector Machines and Other Kernel-Based Learning Methods. Cambridge University Press, 2000.
10. P. Berkhin, “A survey of clustering data mining techniques,” in Grouping Multidimensional Data, 2006, pp. 25–71.
11. “Rock: a robust clustering algorithm for categorical attributes,” in Proc. 15th International Conf. Data Engineering, Washington, DC, 1999, p. 512.
12. M. Dutta, A. K. Mahanta, and A. K. Pujari “Qrock: a quick version of the rock algorithm for clustering of categorical data,” Pattern Recogn. Lett., vol. 26, no. 15, pp. 2364–2373, 2005.
13. A. Torsello, D. Hidovic-Rowe, and M. Pelillo “Polynomial-time metrics for attributed trees,” IEEE Trans. Pattern Analysis Machine Intelligence, vol. 27, no. 7, pp. 1087–1099, 2005.
14. D. H. Crocker and P. Overell, “Augmented BNF for Syntax Specifications: ABNF,” United States, 1997.
15. H. Scholz, “SIP stack fingerprinting and stack difference attacks,” Black Hat Briefings, 2006.
16. P. Baldi, S. Brunak, Y. Chauvin, C. A. Andersen, and H. Nielsen, “Assessing the accuracy of prediction algorithms for classification: an overview,” Bioinformatics, vol. 16, no. 5, pp. 412–24, 2000.
17. C. J. van Rijsbergen, Information Retrieval. Butterworths, 1979.
18. V. Levenshtein, “Binary codes capable of correcting deletions, insertions and reversals,” Soviet Physics Doklady, vol. 10, 1966.
19. Douglas Comer and John C. Lin, “Probing TCP implementations,” in USENIX Summer, 1994, pp. 245–255. [Online]. Available: cite-seer.ist.psu.edu/article/comer94probing.html.
20. G. F. Lyon, Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure, 2009.
21. J. Caballero, S. Venkataraman, P. Poosankam, M. G. Kang, D. Song, and A. Blum, “FiG: automatic fingerprint generation,” in 14th Annual Netw. Distributed Syst. Security Conf. (NDSS 2007), Feb. 2007.
22. H. Kim, K. Claffy, M. Fomenkov, D. Barman, M. Faloutsos, and K. Lee, “Internet traffic classification demystified: myths, caveats, and the best practices,” in Proc. 2008 ACM CoNEXT Conf, pp. 1–12.
23. J. Ma, K. Levchenko, C. Kreibich, S. Savage, and G. M. Voelker, “Unexpected means of protocol inference,” in Proc. Internet Measurement Conf., 2006, pp. 313–326.
24. P. Haffner, S. Sen, O. Spatscheck, and D. Wang, “ACAS: automated construction of application signatures,” in MineNet, S. Sen, C. Ji, D. Saha, and J. McCloskey, editors, 2005, pp. 197–202.
25. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee, “Hypertext Transfer Protocol - HTTP/1.1,” RFC 2616 (Draft Standard), June 1999, updated by RFC 2817. [Online]. Available: http://www.ietf.org/rfc/rfc2616.txt.
26. H. Yan, K. Sripanidkulchai, H. Zhang, Z. Y. Shae, and D. Saha, “Incorporating active fingerprinting into SPIT prevention systems,” Third Annual VoIP Security Workshop, June 2006.
27. J. Francois, H. Abdelnur, R. State, and O. Festor, “Automated behavioral fingerprinting,” in 12th International Symp. Recent Advances Intrusion Detection — RAID 2009, Lecture Notes in Computer Science, to appear, 2009.
28. H. Abdelnur, R. State, and O. Festor, “Advanced network fingerprinting,” in Recent Advances Intrusion Detection Lecture Notes Computer Science, ser. Computer Science, vol. 5230/2008, MIT. Springer, 2008, pp. 372–389.
29. P. Düssel, C. Gehl, P. Laskov, and K. Rieck, “Incorporation of application layer protocol syntax into anomaly detection,” in Proc. 4th International Conf. Inf. Syst. Security, 2008, pp. 188–202.
30. K. Rieck, “Machine learning for application-layer intrusion detection,” Ph.D. dissertation, Fraunhofer Institute FIRST & Berlin Institute of Technology, 2009.
31. M. Collins and N. Duffy, “Convolution kernels for natural language,” Advances in Neural Information Processing Systems. MIT Press, 2001.