Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2009

Volumn , Issue , 2009, Pages

  Song, Yingbo ^a   Keromytis, Angelos D ^a   Stolfo, Salvatore J ^a  

^a Department of Earth and Environmental Sciences   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ECONOMIC AND SOCIAL EFFECTS; HIGHER ORDER STATISTICS; NETWORK LAYERS; NETWORK SECURITY; SPECTROGRAPHS;

ANOMALY DETECTION; CODE INJECTION ATTACKS; DETECTION SENSORS; MACHINE-LEARNING; MARKOV CHAIN MODELS; SPECTROGRAMS; SQL INJECTION; STATISTICAL ANOMALY DETECTION; WEB LAYER; WEB TRAFFIC;

ANOMALY DETECTION;

EID: 85180633963     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (36)

1. th USENIX Security Symposium.”,”August”.
2. P. Biondi”. Shellforge Project,”2006”.
3. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha”. Towards Automatic Generation of Vulnerability-Based Signatures. In ”Proceedings of the IEEE Symposium on Security and Privacy”.
4. M. Costa, J. Crowcroft, M. Castro, and A. Rowstron”. Vigilante: End-to-End Containment of Internet Worms. In ”Proceedings of the Symposium on Systems and Operating Systems Principles (SOSP)”, October.
5. th ACM Conference on Computer and Communications Security (CCS)”,”November”.
6. G. F. Cretu, A. Stavrou, M. E. Locasto, S. J. Stolfo, and A. D. Keromytis. Casting out demons: Sanitizing training data for anomaly detection. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), May 2008.
7. W. Cui, M. Peinado, H. J. Wang, and M. E. Locasto”. ShieldGen: Automated Data Patch Generation for Unknown Vulnerabilities with Informed Probing. In ”Proceedings of the IEEE Symposium on Security and Privacy”,”May”.
8. A. Dempster, N. Laird, and D. Rubin. Maximum likelihood from incomplete data via the em algorithm. Journal of the Royal Statistical Society, pages 1–38, 1977.
9. J. Elson. tcpflow – A TCP Flow Recorder, 2003. http://www.circlemud.org/ jelson/software/tcpflow/.
10. M. V. Gundy, D. Balzarotti, and G. Vigna. Catch Me, If You Can: Evading Network Signatures with Web-based Polymorphic Worms. In Proceedings of the First USENIX Workshop on Offesive Technologies (WOOT), August 2007.
11. A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen”. Detecting Past and Present Intrusions through Vulnerability-Specific Predicates. In ”Proceedings of the Symposium on Systems and Operating Systems Principles (SOSP)”, October.
12. th International Symposium on Recent Advances in Intrusion Detection (RAID)”.
13. H.-A. Kim and B. Karp”. Autograph: Toward Automated, Distributed Worm Signature Detection. In ”Proceedings of the USENIX Security Conference”.
14. O. Kolesnikov and W. Lee. Advanced polymorphic worms: Evading ids by blending in with normal traffic. In Proceedings of the USENIX Security Symposium, 2006.
15. th ACM Conference on Computer and Communications Security (CCS).
16. C. Kruegel, G. Vigna, and W. Robertson. A Mult-Model Approach to the Detection of Web-based Attacks. computer Networks,”48”, 2005.
17. th International Symposium on Recent Advances in Intrusion Detection (RAID)”, pages 207–226,”September”.
18. th ACM Conference on Computer and Communications Security (CCS)”,”November”.
19. B. Livshits and W. Cui. Spectator: Detection and containment of javascript worms. In ”Proceedings of the USENIX Annual Technical Conference”, June 2008.
20. th International Symposium on Recent Advances in Intrusion Detection (RAID)”, pages 82–101, ”September”.
21. Metasploit Developement Team. Metasploit Project,”2006”.
22. J. Newsome, B. Karp, and D. Song”. Polygraph: Automatically Generating Signatures for Polymorphic Worms. In ”Proceedings of the IEEE Symposium on Security and Privacy”,”May”.
23. th Symposium on Network and Distributed System Security (NDSS)”, February 2005.
24. Panda Labs. MPack Uncovered,”2007”.
25. C. Reis, J. Dunagan, H. J. Wang, O. Dubrovsky, and S. Esmeir. Browsershield: Vulnerability-driven filtering of dynamic html. In Proceedings of Symposium on Operating Systems Design and Implementation (OSDI), 2006.
26. SANS. SANS Top 20. http://www.sans.org/top20/.
27. S. Siddharth. Evading NIDS, revisited, 2005. http://www.securityfocus.com/infocus/1852.
28. S. Singh, C. Estan, G. Varghese, and S. Savage”. Automated Worm Fingerprinting. In ”Proceedings of Symposium on Operating Systems Design and Implementation (OSDI)”.
29. Snort Development Team. Snort Project.
30. Y. Song, M. E. Locasto, A. Stavrou, A. D. Keromytis, and S. J. Stolfo. On the Infeasibility of Modeling Polymorphic Shellcode. In ”Proceedings of the ACM Conference on Computer and Communications Security (CCS)”.
31. Sophos. Security threat report. Technical report, Sophos, https://secure.sophos.com/security/whitepapers/sophos-security-report-2008, 7 2008.
32. th International Symposium on Recent Advances in Intrusion Detection (RAID)”, pages 274–291,”October”.
33. H. J. Wang, C. Guo, D. R. Simon, and A. Zugenmaier. Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits. In Proceedings of the ACM SIGCOMM Conference, pages 193–204, August 2004.
34. th International Symposium on Recent Advances in Intrusion Detection (RAID)”, pages 227–246, ”September”.
35. th ACM Conference on Computer and Communications Security (CCS)”,”November”.
36. th USENIX Security Symposium”.