19006089
Processing of massive audit data streams for real-time anomaly intrusion detection
Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico (lpr) and from KLINNS Lab of Xi'an Jiaotong University (ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.
28996873
Distance Measures for Anomaly Intrusion Detection
Heat treatment of shaped articles, larger than films or fibers, formed from anisotropic-melt-forming polymers provides an increase of at least 25% in energy to break in flexure. In at least one direction of measurement the heat treated articles are characterized by a flexural break strength of at least 10,000 psi, maximum strain to break in flexure of at least 2% and a flexural modulus of at least 500,000 psi. In many instances the heat treated articles can be further characterized by a notched Izod impact strength of at least 2 foot-pounds per inch. Since the heat-treated shaped articles have high levels of strength, stiffness and toughness, they are useful as replacements for some metals, e.g., brass.
2256492
Autonomic Intrusion Detection System
We propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection in unlabeled audit data streams. The framework owns ability of self-managing: self-labeling, self-updating and self-adapting. Affinity Propagation (AP) uses the framework to learn a subject's behavior through dynamical clustering of the streaming data. The testing results with a large real HTTP log stream demonstrate the effectiveness and efficiency of the method.
13632117
A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security
Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. In this paper, a new intrusion detection method based on Principle Component Analysis (PCA) with low overhead and high efficiency is presented. System call data and command sequences data are used as information sources to validate the proposed method. The frequencies of individual system calls in a trace and individual commands in a data block are computed and then data column vectors which represent the traces and blocks of the data are formed as data input. PCA is applied to reduce the high dimensional data vectors and distance between a vector and its projection onto the subspace reduced is used for anomaly detection. Experimental results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for real-time intrusion detection.
15943138
Constructing attribute weights from computer audit data for effective intrusion detection
Attributes construction and selection from audit data is the first and very important step for anomaly intrusion detection. In this paper, we present several cross frequency attribute weights to model user and program behaviors for anomaly intrusion detection. The frequency attribute weights include plain term frequency (TF) and various forms of term frequency-inverse document frequency (tfidf), referred to as Ltfidf, Mtfidf and LOGtfidf. Nearest Neighbor (NN) and k-NN methods with Euclidean and Cosine distance measures as well as principal component analysis (PCA) and Chi-square test method based on these frequency attribute weights are used for anomaly detection. Extensive experiments are performed based on command data from Schonlau et al. The testing results show that the LOGtfidf weight gives better detection performance compared with plain frequency and other types of weights. By using the LOGtfidf weight, the simple NN method and PCA method achieve the better masquerade detection results than the other 7 methods in the literature while the Chi-square test consistently returns the worst results. The PCA method is suitable for fast intrusion detection because of its capability of reducing data dimensionality while NN and k-NN methods are suitable for detection of a small data set because of its no need of training process. A HTTP log data set collected in a real environment and the sendmail system call data from University of New Mexico (UNM) are used as well and the results also demonstrate the effectiveness of the LOGtfidf weight for anomaly intrusion detection.
15381526
A general framework for adaptive and online detection of web attacks
Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.
40143819
Efficient Filtering of Large DatasetA User-Centric Paradigm
1194502
Energy-Aware Adaptive Watermarking for Real-Time Image Delivery in Wireless Sensor Networks
A secure image transmission mechanism is necessary when malicious intruders intend to access and modify content delivery over wireless networks. To assure data integrity, authentication is required for multimedia data delivered over wireless image sensor networks. Watermarking technique is an effective vehicle to assert and assure the image data authentications. There have been recent works reported on watermarking, but few with the consideration of energy cost in terms of the data communication and processing, which is a key constraint to many embedded systems and wireless sensor networks. Most watermarking systems only target at minimizing watermarked image distortion and increasing robustness at the source coding site for lossy image processing. The watermarked image distortion caused by error-prone wireless environments during transmission has not been fully considered. In this paper, an innovative energy-aware adaptive watermarking scheme for realtime image delivery is proposed in wireless multimedia sensor networks. This new scheme allocates network resource to protect the watermarked image transmission while embedding watermark coding redundancies into the images. Dynamic watermark thresholds are applied to be adaptive to the network condition (packet loss ratio) and the inter-frame correlation is exploited to reduce processing delay. The simulation results show that the proposed adaptive watermark system can achieve considerable energy efficiency and assure the data integrity.
10324009
A Low-Granularity Classifier for Data Streams with Concept Drifts and Biased Class Distribution
Many applications track streaming data for actionable alerts, which may include, for example, network intrusions, transaction frauds, bio-surveilence abnormalities, and so forth. Some stream classification models are built for this purpose. Due to concept drifts, maintaining a model's up-to-dateness has become one of the most challenging tasks in mining data streams. State-of-the-art approaches, including both the incrementally updated classifiers and the ensemble classifiers, have proved that model update is a very costly process. In this paper, we show that reducing model granularity reduces the update cost, as models of fine granularity enable us to efficiently pinpoint local components in the model that are affected by the concept drift. It also enables us to derive new model components to reflect the current data distribution, thus avoiding expensive updates on a global scale. Furthermore, those actionable alerts being monitored are usually rare occurrences. The existing stream classifiers cannot handle this problem. We address this problem and show that the low-granularity classifier handles rare events on stream data with ease. Experiments on real and synthetic data show that our approach is able to maintain good prediction accuracy at a fraction of the model updating cost of state-of-the-art approaches.
19122402
Moduli selection in RNS for efficient VLSI implementation
In this paper, we carry out a study on an important issue concerning the use of residue numbers in the design of digital systems, namely, the moduli selection. Based on a new formulation of the Chinese remainder theorem and the efficient residue-to-binary (R/B) converters designed therefrom, we propose a guideline for the selection of the low-cost moduli sets for different dynamic ranges. These sets consist of the low-cost moduli of the form 2/sup n/, ( 2/sup n/-1) or (2/sup n/ + 1), which can offer simplified modulo adders and multipliers. It is shown that for medium dynamic ranges (less than 22 bits), the three-moduli set {2/sup n/,2/sup n/ + 1,2/sup n/ - 1} is the most efficient one in terms of the design of a complete RNS system. On the other hand, for large dynamic ranges (equal to or larger than 22 bits), the general-moduli set in the form (2/sup n/, 2/sup n/ + 1,2/sup n/ - 1,2/sup n/ /spl plusmn/1,...,2/sup n/, /spl plusmn/1), with a length greater than three, is the most efficient one. These results provide the possibility of a wide range of applications of the residue number system in the design of DSP, telecommunication and cryptography systems.
14325893
Maintaining K-Anonymity against Incremental Updates
K-anonymity is a simple yet practical mechanismto protect privacy against attacks of re-identifying individuals by joining multiple public data sources. All existing methods achieving k-anonymity assume implicitly that the data objects to be anonymized are given once and fixed. However, in many applications, the real world data sources are dynamic. In this paper, we investigate the problem of maintaining k-anonymity against incremental updates, and propose a simple yet effective solution. We analyze how inferences from multiple releases may temper the k-anonymity of data, and propose the monotonic incremental anonymization property. The general idea is to progressively and consistently reduce the generalization granularity as incremental updates arrive. Our new approach guarantees the k-anonymity on each release, and also on the inferred table using multiple releases. At the same time, our new approach utilizes the more and more accumulated data to reduce the information loss.