An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection
Lecture notes in computer sciencePublished 1 January 2003
Matthew V. Mahoney, Philip K. Chan
Citations538
SJR quartileQ2
SJR score0.35
SNIP0.55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This investigation of the 1999 background network traffic suggests the presence of simulation artifacts that would lead to overoptimistic evaluation of network anomaly detection systems.
Abstract
The DARPA/MIT Lincoln Laboratory off-line intrusion detection evaluation data set is the most widely used public benchmark for testing intrusion detection systems. Our investigation of the 1999 background network traffic suggests the presence of simulation artifacts that would lead to overoptimistic evaluation of network anomaly detection systems. The effect can be mitigated without knowledge of specific artifacts by mixing real traffic into the simulation, although the method requires that both the system and the real traffic be analyzed and possibly modified to ensure that the system does not model the simulated traffic independently of the real traffic.
Keywords
Computer Science
Snort - Lightweight Intrusion Detection for Networks
3,106 Citations1999Martin Roesch
Snort provides a layer of defense which monitors network traffic for predefined suspicious activity or patterns, and alert system administrators when potential hostile traffic is detected.
ACM Transactions on Information and System SecurityTesting Intrusion detection systems
1,303 Citations2000John McHugh
The purpose of this article is to attempt to identify the shortcomings of the Lincoln Lab effort in the hope that future efforts of this kind will be placed on a sounder footing.
On the self-similar nature of Ethernet traffic
1,078 Citations1993W.E. Leland, Murad S. Taqqu +2 more
It is demonstrated that Ethernet local area network (LAN) traffic is statistically self-similar, that none of the commonly used traffic models is able to capture this fractal behavior, and that such behavior has serious implications for the design, control, and analysis of high-speed, cell-based networks.
Computer NetworksThe 1999 DARPA off-line intrusion detection evaluation
860 Citations2000Richard P. Lippmann, Joshua Haines +3 more
This report describes new and known approaches and strategies that were used to make attacks stealthy for the 1999 DARPA Intrusion Detection Evaluation, and includes many examples of stealthy scripts that can be use to implement stealthy procedures.
Columbia Academic Commons (Columbia University)Intrusion detection with unlabeled data using clustering
756 Citations2000Leonid Portnoy
IEEE/ACM Transactions on NetworkingDifficulties in simulating the Internet
725 Citations2001Sally Floyd, Vern Paxson
Two key strategies for developing meaningful simulations in the face of the global Internet's great heterogeneity are discussed: searching for invariants and judiciously exploring the simulation parameter space.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
655 Citations1998Thomas H. Ptacek, Timothy N. Newsham
Three classes of attacks which exploit fundamentally problems with the reliability of passive protocol analysis are defined--insertion, evasion and denial of service attacks--and how to apply these three types of attacks to IP and TCP protocol analysis is described.
A fast automaton-based method for detecting anomalous program behaviors
560 Citations2002R. Sekar, Mr. Rushant Bendre +2 more
This paper describes the FSA based technique and presents a comprehensive experimental evaluation of the technique, which can capture both short term and long term temporal relationships among system calls, and thus perform more accurate detection.
Columbia Academic Commons (Columbia University)Anomaly Detection over Noisy Data Using Learned Probability Distributions
488 Citations2000Eleazar Eskin
A study in using neural networks for anomaly and misuse detection
396 Citations1999A. K. Ghosh, Aaron Schwartzbard
New process-based intrusion detection approaches are described that provide the ability to generalize from previously observed behavior to recognize future unseen behavior and can be used for both anomaly detection and misuse detection.
Specification-based anomaly detection
364 Citations2002R. Sekar, Ajay Gupta +5 more
Whereas feature selection was a crucial step that required a great deal of expertise and insight in the case of previous anomaly detection approaches, it is shown that the use of protocol specifications in the approach simplifies this problem.
Learning nonstationary models of normal network traffic for detecting novel attacks
320 Citations2002Matthew V. Mahoney, Philip K. Chan
This paper proposes a learning algorithm that constructs models of normal behavior from attack-free network traffic that can be combined to increase coverage of traditional intrusion detection systems.
Journal of Quantitative LinguisticsGood‐turing frequency estimation without tears*
314 Citations1995William A. Gale, Geoffrey Sampson
The Simple Good–Turing estimator is defined, which is straightforward to use and performs well, absolutely and relative both to the approaches just discussed and to other, more sophisticated techniques.
Lecture notes in computer scienceAdaptive, Model-Based Monitoring for Cyber Attack Detection
307 Citations2000Alfonso Valdes, Keith Skinner
A high-performance, adaptive, model-based technique for attack detection, using Bayes net technology to analyze bursts of traffic, which has the attractive features of both signature based and statistical techniques: model specificity, adaptability, and generalization potential.
Detecting Novel Network Intrusions Using Bayes Estimators
292 Citations2001Daniel Barbará, Ningning Wu +1 more
This work has been funded by AFRL Rome Labs under the contract F 30602-00-2-0512 and aims to detect well-known attacks as well as slight variations of them, by characterizing the rules that govern these attacks.
ACM SIGKDD Explorations NewsletterResults of the KDD'99 classifier learning
288 Citations2000Charles Elkan
The task for the classifier learning contest organized in conjunction with the KDD’99 conference was to learn a predictive model capable of distinguishing between legitimate and illegitimate connections in a computer network.
Bro: a system for detecting network intruders in real-time
284 Citations1998Vern Paxson
Journal of Computer SecurityNetSTAT: A network-based intrusion detection system
273 Citations1999Giovanni Vigna, Richard A. Kemmerer
This paper presents a new approach that applies the State Transition Analysis Technique (STAT) to network intrusion detection, able to determine which network events have to be monitored and where they can be monitored, providing automatic support for configuration and placement of intrusion detection components.
Zipf, Power-laws, and Pareto-a ranking tutorial
272 Citations2000Lada A. Adamic
Advances in information securityApplications of Data Mining in Computer Security
271 Citations2002Daniel Barbará, Sushil Jajodia
Modern Intrusion Detection, Data Mining, and Degrees of Attack Guilt, and Degrees of Attack Guilt are discussed.
SSRN Electronic JournalThe Nature of Markets in the World Wide Web
270 Citations2000Lada A. Adamic, Bernardo A. Huberman
It is found that the distribution of visitors per site follows a universal power law similar to that found by Pareto for income distributions, which implies that a small number of sites commands the traffic of a large segment of the Web population, a phenomenon reminiscent of winner-take-all markets.
Lecture notes in computer scienceAnalysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation
230 Citations2000Richard P. Lippmann, Joshua Haines +3 more
Eight sites participated in the second DARPA off-line intrusion detection evaluation in 1999 and best detection was provided by network-based systems for old probe and old denial-of-service (DoS) attacks and by host- based systems for Solaris user-to-root (U2R) attacks.
Network traffic anomaly detection based on packet bytes
223 Citations2003Matthew V. Mahoney
A two stage anomaly detection system for identifying suspicious traffic that model the most common protocols at the packet byte level to flag events that have not been observed for a long time.
On-line unsupervised outlier detection using finite mixtures with discounting learning algorithms
221 Citations2000Kenji Yamanishi, Jun’ichi Takeuchi +2 more
Experience with EMERALD to Date
212 Citations1999Peter G. Neumann, Phillip Porras
Learning rules for anomaly detection of hostile network traffic
200 Citations2003Matthew V. Mahoney, Philip K. Chan
An algorithm called LERAD that learns rules for finding rare events in nominal time-series data with long range dependencies is introduced that is used to find anomalies in network packets and TCP sessions to detect novel intrusions.
PHAD: packet header anomaly detection for identifying hostile network traffic
178 Citations2001Matthew V. Mahoney, Philip K. Chan
An experimental packet header anomaly detector (PHAD) that learns the normal range of values for 33 fields of the Ethernet, IP, TCP, UDP, and ICMP protocols, and results were obtained by examining packets and fields in isolation, and by using simple nonstationary models.
Using Text Categorization Techniques for Intrusion Detection
165 Citations2002Yi‐Hua Liao, V. Rao Vemuri
A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive, and preliminary experiments with 1998 DARPA BSM audit data show that the kNN classifier can effectively detect intrusive attacks and achieve a low false positive rate.
A high-performance network intrusion detection system
121 Citations1999R. Sekar, Yao Guang +2 more
This paper presents a new approach for network intrusion detection based on concise specifications that characterize normal and abnormal network packet sequences, which can easily support new network protocols as information relating to the protocols are not hard-coded into the system.
Iowa State University Digital Repository (Iowa State University)Synthesizing fast intrusion prevention/detection systems from high-level specifications
120 Citations1999R. Sekar, Prem Uppuluri
A new, low-overhead algorithm for matching runtime behaviors against specifications based on specifying intended program behaviors using patterns over sequences of system calls that is capable of reacting before any damage-causing system call is executed by a process under attack.
The STAT tool suite
97 Citations2002Giovanni Vigna, Steven T. Eckmann +1 more
A suite of intrusion detection tools developed by the Reliable Software Group at the University of California at Santa Barbara using the state transition analysis technique, which supports software reuse, portability and extendibility, and it allows for the optimization of critical functionalities.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)1999 DARPA Intrusion Detection Evaluation: Design and Procedures
74 Citations2001Joshua Haines, Richard P. Lippmann +3 more
Objectives of this effort were to support algorithm development, perform a blind, off-line evaluation of intrusion detection approaches, and help DARPA guide research directions.
A machine learning approach to detecting attacks by identifying anomalies in network traffic
52 Citations2003Philip K. Chan, Matthew V. Mahoney
A dissertation submitted to the College of Engineering at Florida Institute of Technology in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science.
Learning Models of Network Traffic for Detecting Novel Attacks
52 Citations2002Matthew V. Mahoney, Philip K. Chan
It is believed that anomaly detection can work because most attacks exploit software or configuration errors that escaped field testing, so are only exposed under unusual conditions.
Recent Advances in Intrusion DetectionA Study in the Feasibility of Performing Host-Based Anomaly Detection on Windows NT.
9 Citations1999Aaron Schwartzbard, A. K. Ghosh
The feasibility of applying host-based intrusion detection to the Windows NT platform is examined and the relevant issues in performing program-based anomaly detection on the WindowsNT platform and the auditing facilities available on the platform for supporting this approach are described.