17218997
Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data
Intrusion detection is an important technique in the defense-in-depth network security framework. In recent years, it has been a widely studied topic in computer network security. In this paper, we present two methods, namely, the Hidden Markov Models (HMM) method and the Self Organizing Maps (SOM) method, to profile normal program behavior for anomaly intrusion detection based on computer audit data. The HMM method utilizes the transition property of events while SOM method relies on the frequency property of events. Two data sets, CERT synthetic Sendmail system call data collected in the University of New Mexico (UNM) and Live FTP system call data collected in the CNSIS lab of Xi'an Jiaotong University, were used to assess the two methods. Testing results show that the HMM method using the transition property of events produces good detection performance while high computational expense is required both for training and detection. The HMM method is better than other two methods reported previously in terms of detection accuracy for the same data set. The SOM method considering the frequency property of events, on the other hand, is suitable for real-time intrusion detection because of its capability of processing a large amount of data with low computational overhead.
19006089
Processing of massive audit data streams for real-time anomaly intrusion detection
Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico (lpr) and from KLINNS Lab of Xi'an Jiaotong University (ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.
2256492
Autonomic Intrusion Detection System
We propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection in unlabeled audit data streams. The framework owns ability of self-managing: self-labeling, self-updating and self-adapting. Affinity Propagation (AP) uses the framework to learn a subject's behavior through dynamical clustering of the streaming data. The testing results with a large real HTTP log stream demonstrate the effectiveness and efficiency of the method.
13632117
A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security
Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. In this paper, a new intrusion detection method based on Principle Component Analysis (PCA) with low overhead and high efficiency is presented. System call data and command sequences data are used as information sources to validate the proposed method. The frequencies of individual system calls in a trace and individual commands in a data block are computed and then data column vectors which represent the traces and blocks of the data are formed as data input. PCA is applied to reduce the high dimensional data vectors and distance between a vector and its projection onto the subspace reduced is used for anomaly detection. Experimental results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for real-time intrusion detection.
15381526
A general framework for adaptive and online detection of web attacks
Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.
13221631
Fast intrusion detection based on a non-negative matrix factorization model
In this paper, we present an efficient fast anomaly intrusion detection model incorporating a large amount of data from various data sources. A novel method based on non-negative matrix factorization (NMF) is presented to profile program and user behaviors of a computer system. A large amount of high-dimensional data is collected in our experiments and divided into smaller data blocks by a specific scheme. The system call data is divided into blocks by processes, while command data is divided into consecutive blocks with a fixed length. The frequencies of individual elements in each block of data are computed and placed column by column as data vectors to construct a matrix representation. NMF is employed to reduce the high-dimensional data vectors and anomaly detection can be realized as a very simple classifier in low dimensions. Experimental results show that the model presented in this paper is promising in terms of detection accuracy, computation efficiency and implementation for fast intrusion detection.
32286255
Hardware Organization to Achieve High-Speed Elliptic Curve Cryptography for Mobile Devices
Elliptic curve cryptography (ECC) is recognized as a fast cryptography system and has many applications in security systems. In this paper, a novel sharing scheme is proposed to significantly reduce the number of field multiplications and the usage of lookup tables, providing high speed operations for both hardware and software realizations.
11942108
Subspace Partitioning for Target Detection and Identification
Detection of a given target or set of targets from observed data is a problem countered in many applications. Regardless of the algorithm selected, detection performance can be severely degraded when the subspace defined by the target data set is singular or ill conditioned. High correlations between target components and their linear combinations lead to false positives and misidentifications, especially for subspace-based detectors. In this paper, we propose a subspace partitioning scheme that allows for detection to be performed in a number of better conditioned subspaces instead of the original subspace. The proposed technique is applied to Raman spectroscopic data analysis. Through both simulation and experimental results, we demonstrate the improvement in the overall detection performance when using the proposed subspace partitioning scheme in conjunction with several subspace detection methods that are commonly used in practice.
2548187
Mining asynchronous periodic patterns in time series data
Periodicy detection in time series data is a challenging problem of great importance in many applications. Most previous work focused on mining synchronous periodic patterns and did not recognize the misaligned presence of a pattern due to the intervention of random noise. In this paper, we propose a more flexible model of asynchronous periodic pattern that may be present only within a subsequence and whose occurrences may be shifted due to disturbance. Two parameters min rep and max dis are employed to specify the minimum number of repetitions that is required within each segment of nondisrupted pattern occurrences and the maximum allowed disturbance between any two successive valid segments. Upon satisfying these two requirements, the longest valid subsequence of a pattern is returned. A two-phase algorithm is devised to first generate potential periods by distance-based pruning followed by an iterative procedure to derive and validate candidate patterns and locate the longest valid subsequence. We also show that this algorithm cannot only provide linear time complexity with respect to the length of the sequence but also achieve space
31089666
A Novel Active Learning Approach for SVM Based Web Image Retrieval
There is a great deal of research conducted on hyperplane based query such as Support Vector Machine (SVM) in Content-based Image Retrieval(CBIR). However, the SVM-based CBIR always suffers from the problem of the imbalance of image data. Specifically, the number of negative samples (irrelevant images) is far more than that of the positive ones. To deal with this problem, we propose a new active learning approach to enhance the positive sample set in SVM-based Web image retrieval. In our method, instead of using complex parsing methods to analyze Web pages, two kinds of "lightweight" image features: the URL of the Web image and its visual features, which can be easily obtained, are applied to estimate the probability of the image being a potential positive sample. The experiments conducted on a test data set with more than 10,000 images from about 50 different Web sites demonstrate that compared with traditional methods, our approach improves the retrieval performance significantly.
17985885
A Coverage-Based Maximum Lifetime Data Gathering Algorithm in Sensor Networks
Wireless sensor networks have emerged recently as an effective way of gathering useful information from areas of interest. Prolonging the network lifetime has become the primary concern in data gathering due to the limited battery power of sensors. An underlying assumption of most existing work is that all the sensors are working simultaneously during the whole process of data gathering. In this paper, we introduce a new definition of the network lifetime in view of the coverage condition, and then investigate the coverage-based maximum lifetime data gathering problem theoretically. Two critical issues are how to selectively organize part of sensors to work and how to execute routing in a single working set. Considering both of these two problems together, we propose the algorithm CODAG. CODAG employs the tree structured routing scheme and enables the routing effects of two different sets theoretically comparable. Based on the maximal increased weight in the routing tree, it divides all the sensors into disjoint cover sets without redundant ones, which in turn leads to the better routing effect. Experimental results show that our algorithm has the good performance for prolonging the lifetime of the whole sensor network.