|
|
|
xiii | |
|
|
|
xvii | |
| Preface |
|
xix | |
|
Modern Instrusion Detection, Data Mining, and Degrees of Attack Guilt |
|
|
1 | (32) |
|
|
|
|
|
|
|
|
|
2 | (1) |
|
|
|
3 | (9) |
|
|
|
4 | (1) |
|
|
|
4 | (1) |
|
|
|
5 | (1) |
|
State-Transition Analysis |
|
|
6 | (1) |
|
|
|
7 | (1) |
|
|
|
8 | (1) |
|
|
|
8 | (1) |
|
|
|
9 | (1) |
|
|
|
10 | (1) |
|
|
|
10 | (2) |
|
|
|
12 | (1) |
|
|
|
12 | (2) |
|
|
|
14 | (11) |
|
|
|
15 | (1) |
|
|
|
16 | (1) |
|
|
|
17 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (1) |
|
|
|
20 | (5) |
|
|
|
25 | (8) |
|
|
|
25 | (8) |
|
Data Mining for Intrusion Detection |
|
|
33 | (30) |
|
|
|
|
|
33 | (1) |
|
|
|
34 | (7) |
|
Data Mining, KDD, and Related Fields |
|
|
34 | (2) |
|
Some Data Mining Techniques |
|
|
36 | (1) |
|
|
|
37 | (1) |
|
|
|
38 | (1) |
|
|
|
39 | (1) |
|
|
|
40 | (1) |
|
Research Challenges in Data Mining |
|
|
40 | (1) |
|
Data Mining Meets Intrusion Detection |
|
|
41 | (9) |
|
|
|
43 | (2) |
|
|
|
45 | (1) |
|
Clustering of Unlabeled ID Data |
|
|
46 | (1) |
|
|
|
47 | (2) |
|
|
|
49 | (1) |
|
Observations on the State of the Art |
|
|
50 | (4) |
|
Data Mining, but no Knowledge Discovery |
|
|
50 | (1) |
|
Disregard of Other KDD Steps |
|
|
51 | (1) |
|
|
|
52 | (1) |
|
Narrow Scope of Research Activities |
|
|
53 | (1) |
|
Future Research Directions |
|
|
54 | (2) |
|
|
|
56 | (7) |
|
|
|
57 | (6) |
|
An Architecture for Anomaly Detection |
|
|
63 | (14) |
|
|
|
|
|
|
|
|
|
|
|
63 | (2) |
|
|
|
65 | (2) |
|
|
|
65 | (1) |
|
|
|
65 | (2) |
|
|
|
67 | (1) |
|
|
|
67 | (1) |
|
ADAM: an implementation of the architecture |
|
|
67 | (5) |
|
|
|
72 | (1) |
|
Breaking the dependency on training data |
|
|
73 | (1) |
|
|
|
74 | (3) |
|
|
|
75 | (2) |
|
A Geometric Framework for Unsupervised Anomaly Detection |
|
|
77 | (26) |
|
|
|
|
|
|
|
|
|
|
|
|
|
78 | (3) |
|
Unsupervised Anomaly Detection |
|
|
81 | (2) |
|
A Geometric Framework for Unsupervised Anomaly Detection |
|
|
83 | (2) |
|
|
|
83 | (1) |
|
|
|
84 | (1) |
|
|
|
85 | (1) |
|
Detecting Outliers in Feature Spaces |
|
|
85 | (1) |
|
Algorithm 1: Cluster-based Estimation |
|
|
86 | (1) |
|
Algorithm 2: K-nearest neighbor |
|
|
87 | (2) |
|
Algorithm 3: One Class SVM |
|
|
89 | (2) |
|
Feature Spaces for Intrusion Detection |
|
|
91 | (2) |
|
Data-dependent Normalization Kernels |
|
|
92 | (1) |
|
Kernels for Sequences: The Spectrum Kernel |
|
|
92 | (1) |
|
|
|
93 | (5) |
|
|
|
93 | (1) |
|
|
|
94 | (1) |
|
|
|
95 | (1) |
|
|
|
96 | (2) |
|
|
|
98 | (5) |
|
|
|
99 | (4) |
|
Fusing a Heterogeneous Alert Stream into Scenarios |
|
|
103 | (20) |
|
|
|
|
|
|
|
104 | (1) |
|
|
|
105 | (1) |
|
|
|
106 | (1) |
|
|
|
107 | (1) |
|
|
|
108 | (7) |
|
|
|
108 | (3) |
|
|
|
111 | (1) |
|
|
|
112 | (2) |
|
|
|
114 | (1) |
|
|
|
115 | (4) |
|
|
|
116 | (1) |
|
|
|
117 | (1) |
|
|
|
117 | (2) |
|
|
|
119 | (1) |
|
|
|
120 | (3) |
|
|
|
120 | (3) |
|
Using MIB II Variables for Network Intrusion Detection |
|
|
123 | (30) |
|
|
|
|
|
|
|
|
|
|
|
124 | (1) |
|
|
|
125 | (2) |
|
|
|
125 | (1) |
|
Entropy and Conditional Entropy |
|
|
126 | (1) |
|
|
|
127 | (7) |
|
|
|
127 | (2) |
|
|
|
129 | (1) |
|
Anomaly Detection Model Design Overview |
|
|
129 | (1) |
|
Anomaly Detection Module Construction |
|
|
129 | (5) |
|
Experiments and Performance Evaluation |
|
|
134 | (12) |
|
|
|
134 | (1) |
|
|
|
135 | (1) |
|
|
|
135 | (5) |
|
|
|
140 | (6) |
|
|
|
146 | (2) |
|
|
|
148 | (1) |
|
Conclusions and Future Work |
|
|
149 | (4) |
|
|
|
149 | (4) |
|
Adaptive Model Generation |
|
|
153 | (42) |
|
|
|
|
|
|
|
|
|
|
|
154 | (3) |
|
Components of Adaptive Model Generation |
|
|
157 | (18) |
|
|
|
159 | (4) |
|
|
|
163 | (2) |
|
Detection Model Management |
|
|
165 | (2) |
|
|
|
167 | (7) |
|
|
|
174 | (1) |
|
Capabilities of Adaptive Model Generation |
|
|
175 | (4) |
|
Real Time Detection Capabilities |
|
|
175 | (1) |
|
Automatic Data Collection and Data Warehousing |
|
|
175 | (1) |
|
Model Generation and Management |
|
|
176 | (1) |
|
Data Analysis Capabilities |
|
|
176 | (2) |
|
Correlation of Multiple Sensors |
|
|
178 | (1) |
|
Model Generation Algorithms |
|
|
179 | (1) |
|
|
|
179 | (1) |
|
|
|
179 | (1) |
|
Unsupervised Anomaly Detection |
|
|
180 | (1) |
|
Model Generation Example: SVM |
|
|
180 | (5) |
|
|
|
181 | (1) |
|
SVM for Misuse Detection in AMG |
|
|
182 | (1) |
|
Unsupervised SVM Algorithm |
|
|
183 | (1) |
|
Unsupervised SVM for Unsuperivised Anomaly Detection |
|
|
184 | (1) |
|
System Example 1: Registry Anomaly Detection |
|
|
185 | (2) |
|
|
|
185 | (1) |
|
|
|
185 | (1) |
|
The RAD Classification Algorithm |
|
|
186 | (1) |
|
|
|
187 | (1) |
|
|
|
187 | (3) |
|
|
|
188 | (1) |
|
Haunt Classification Algorithm |
|
|
188 | (1) |
|
|
|
188 | (1) |
|
|
|
189 | (1) |
|
|
|
190 | (5) |
|
|
|
191 | (4) |
|
Proactive Intrusion Detection |
|
|
195 | (34) |
|
|
|
|
|
|
|
|
|
|
|
|
|
196 | (2) |
|
Information Assurance, Data Mining, and Proactive Intrusion Detection |
|
|
198 | (8) |
|
Intrusion Detection Systems |
|
|
198 | (1) |
|
|
|
198 | (6) |
|
Proactive Intrusion Detection |
|
|
204 | (2) |
|
A methodology for discovering precursors - Assumptions, Objectives, Procedure and Analysis |
|
|
206 | (11) |
|
|
|
206 | (1) |
|
Time Series, Multivariate Time Series and Collections |
|
|
206 | (1) |
|
Events, Event Sequences, Causal Rules and Precursor Rules |
|
|
207 | (1) |
|
Assumptions, Problem Set-Up, Objectives and Procedure |
|
|
208 | (3) |
|
Analysis - Detection and Gradation of Causality in Time Series |
|
|
211 | (1) |
|
|
|
211 | (1) |
|
The Granger Causality Test as an Exploratory Tool |
|
|
212 | (1) |
|
GCT and the Extraction of Precurosor Rules - Modeling and Theoretical Developments |
|
|
213 | (4) |
|
A Case Study - Precursor Rules for Distributed Denial of Service Attacks |
|
|
217 | (5) |
|
DDoS Attacks and the experiments |
|
|
217 | (2) |
|
TFN2K Ping Flood - Extracting Precurosor Rules |
|
|
219 | (3) |
|
|
|
222 | (7) |
|
|
|
223 | (6) |
|
E-mail Authorship Attribution for Computer Forensics |
|
|
229 | (1) |
|
|
|
|
|
|
|
|
|
Introduction and Motivation |
|
|
230 | (1) |
|
|
|
230 | (2) |
|
|
|
232 | (2) |
|
|
|
234 | (4) |
|
E-mail Authorship Attribution |
|
|
238 | (1) |
|
Support Vector Machine Classifier |
|
|
239 | (1) |
|
E-mail Corpus and Methodology |
|
|
240 | (4) |
|
|
|
244 | (2) |
|
|
|
246 | (1) |
|
|
|
247 | |