Activity profiles for intrusion detection

Kohout, Ladislav; Yasinsac, Alec; McDuffie, Ernest

doi:10.1109/nafips.2002.1018104

Cited by 5 publications

(1 citation statement)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The work by [17][18][19] describes attack patterns or normal behavior patterns using Allen's temporal relations [20] such as "before", "after" and "meet" between events (e.g., a login by user x should be followed by a logout).…”

Section: Related Workmentioning

confidence: 99%

Using the KBTA method for inferring computer and network security alerts from time-stamped, raw system metrics

Shabtai¹,

Fledel²,

Elovici³

et al. 2009

J Comput Virol

View full text Add to dashboard Cite

In this study, we propose a new approach for detecting previously unencountered instances of known classes of malicious software based on their temporal behavior. In the proposed approach, time-stamped security data are continuously monitored within the target computer system or network and then processed by the knowledge-based temporal abstraction (KBTA) methodology. Using KBTA, continuously measured data (e.g., the number of running processes) and events (e.g., installation of a software) are integrated with a security-domain, temporal-abstraction knowledge-base (i.e., a security ontology for abstracting meaningful patterns from raw, time-oriented security data), to create higher-level, time-oriented concepts and patterns, also known as temporal abstractions. Automatically-generated temporal abstractions can be monitored to detect suspicious temporal patterns. These patterns are compatible with a set of predefined classes of malware as defined by a security expert employing a set of time and value constraints. The new approach was applied for detecting worm-related malware using two different ontologies. Evaluation results demonstrated the effectiveness of the new approach. The approach can be used for detecting other types of malware by updating the security ontology with new definitions of temporal patterns.

show abstract

Section: Related Workmentioning

confidence: 99%

Using the KBTA method for inferring computer and network security alerts from time-stamped, raw system metrics

Shabtai¹,

Fledel²,

Elovici³

et al. 2009

J Comput Virol

View full text Add to dashboard Cite

show abstract

Notice of Violation of IEEE Publication Principles: Which models should be applied to measure computer security and information assurance?

Reznik

2003

The 12th IEEE International Conference on Fuzzy Systems, 2003. FUZZ '03.

View full text Add to dashboard Cite

Absrracf-The paper attempts to investigate a feasibility of developing new models and methodologies integrating probabilistic and soft computing techniques and applying them to measurement of computer system security. It reviews the methods, which have been developed and applied by now for this purpose, and analyses their applicability. It concludes that neither of methodologies being applied for measurement of computer security andlor reliability may he considered as comprehensive and good. Summarizing the required features of the measurement models, the paper concludes that new synergetic models and approaches need to he developed.

show abstract

Constructing Communication Profiles by Clustering Selected Network Traffic Attributes

Knuuti

Seppälä

Alapaholuoma

et al. 2010

2010 Fifth International Conference on Internet Monitoring and Protection

View full text Add to dashboard Cite

Activity profiles for intrusion detection

Cited by 5 publications

References 11 publications

Using the KBTA method for inferring computer and network security alerts from time-stamped, raw system metrics

Using the KBTA method for inferring computer and network security alerts from time-stamped, raw system metrics

Notice of Violation of IEEE Publication Principles: Which models should be applied to measure computer security and information assurance?

Constructing Communication Profiles by Clustering Selected Network Traffic Attributes

Contact Info

Product

Resources

About