Robust Support Vector Machines for Anomaly Detection in Computer Security.
International Conference on Machine Learning and ApplicationsPublished 1 January 2003
Wenjie Hu, Yi‐Hua Liao, V. Rao Vemuri
Citations184
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
Using the 1998 DARPA BSM data set collected at MIT’s Lincoln Labs to study intrusion detection systems, the performance of robust support vector machines (RVSMs) was compared with that of conventionalSupport vector machines and nearest neighbor classifiers in separating normal usage profiles from intrusive profiles of computer programs.
Abstract
A cDNA library was prepared from a terminal deoxynucleotidyltransferase-containing thymoma in the lambda phage vector lambda gt11. By screening plaques with anti-terminal transferase antibody, positive clones were identified of which some had beta-galactosidase-cDNA fusion proteins identifiable after electrophoretic fractionation by immunoblotting with anti-terminal transferase antibody. The predominant class of cross-hybridizing clones was determined to represent cDNA for terminal transferase by showing that one representative clone hybridized to a 2200-nucleotide mRNA in close-matched enzyme-positive but not to enzyme-negative cells and that the cDNA selected a mRNA that translated to give a protein of the size and antigenic characteristics of terminal transferase. Only a small amount of genomic DNA hybridized to the longest available clone, indicating that the sequence is virtually unique in the mouse genome.
Keywords
Computer Science
Machine LearningSupport-Vector Networks
33,035 Citations1995Corinna Cortes, Vladimir Vapnik
High generalization ability of support-vector networks utilizing polynomial input transformations is demonstrated and the performance of the support- vector network is compared to various classical learning algorithms that all took part in a benchmark study of Optical Character Recognition.
TechnometricsStatistical Learning Theory
26,913 Citations1999Yuhai Wu, Vladimir Vapnik
Presenting a method for determining the necessary and sufficient conditions for consistency of learning process, the author covers function estimates from small data pools, applying these estimations to real-life problems, and much more.
Data Mining and Knowledge DiscoveryA Tutorial on Support Vector Machines for Pattern Recognition
16,433 Citations1998Christopher J. C. Burges
There are several arguments which support the observed high accuracy of SVMs, which are reviewed and numerous examples and proofs of most of the key theorems are given.
Detecting intrusions using system calls: alternative data models
1,107 Citations2003C. Warrender, Stephanie Forrest +1 more
This work compares the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions and concludes that for this particular problem, weaker methods than HMMs are likely sufficient.
Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
899 Citations2002Richard P. Lippmann, David J. Fried +9 more
An intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100's of users on 1000's of hosts and the best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users.
Computer NetworksTowards a taxonomy of intrusion-detection systems
806 Citations1999Hervé Debar, Marc Daciér +1 more
A taxonomy of intrusion-detection systems is introduced that highlights the various aspects of this area and is illustrated by numerous examples from past and current projects.
Computers & SecurityUse of K-Nearest Neighbor classifier for intrusion detection
799 Citations2002Yi‐Hua Liao, V. Rao Vemuri
A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive, and seems to offer some computational advantages over those that seek to characterize program behavior with short sequences of system calls and generate individual program profiles.
Columbia Academic Commons (Columbia University)Anomaly Detection over Noisy Data Using Learned Probability Distributions
488 Citations2000Eleazar Eskin
Learning program behavior profiles for intrusion detection
401 Citations1999A. K. Ghosh, Aaron Schwartzbard +1 more
Three anomaly detection techniques for prooling program behavior that evolve from memorization to generalization are presented, which start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior.
A study in using neural networks for anomaly and misuse detection
396 Citations1999A. K. Ghosh, Aaron Schwartzbard
New process-based intrusion detection approaches are described that provide the ability to generalize from previously observed behavior to recognize future unseen behavior and can be used for both anomaly detection and misuse detection.
A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems
380 Citations1999K. R. Kendall
The focus of this thesis is the attacks that were developed for use in the 1998 DARPA intrusion detection evaluation and included older, well-known attacks, newer attacks that have recently been released to publicly available forums, and some novel attacks developed specifically for this evaluation.
Columbia Academic Commons (Columbia University)Learning Patterns from Unix Process Execution Traces for Intrusion Detection
271 Citations1997Wenke Lee, Saivatore J. Stolfo +1 more
The preliminary experiments to extend the work pioneered by Forrest on learning the (normal abnormal) patterns of Unix processes can be used to identify misuses of and intrusions in Unix systems indicate that machine learning can play an important role by generalizing stored sequence information to perhaps provide broader intrusion detection services.
An Application of Machine Learning to Anomaly Detection
184 Citations1999Terran Lane
A machine learning approach to anomaly detection that builds user profiles based on command sequences and compares current input sequences to the profile using a similarity measure and demonstrates that this is a promising approach to distinguishing the legitamate user from an intruder.
Intrusion detection. Applying machine learning to Solaris audit data
106 Citations2002D. Endler
The Basic Security Module auditing tool of Sun's Solaris operating environment was used in both an anomaly and misuse detection approach, demonstrating the potential benefits of combining both aspects of detection in future IDSs to decrease false positive and false negative errors.
Profiling users in the UNIX os environment
10 Citations2000V N P Dao
This paper presents results obtained by using a method of profiling a user based on the login host, the login time, thecommand set, and the command set execution time of the profiled user.