Intrusion detection using neural networks and support vector machines

Mukkamala, Srinivas; Janoski, Guadalupe I.; Sung, Andrew H.

doi:10.1109/ijcnn.2002.1007774

Cited by 561 publications

(283 citation statements)

References 4 publications

Supporting

Mentioning

245

Contrasting

Unclassified

Order By: Relevance

“…In machine learning, support vector machines (SVMs, also support vector networks) [14] When data is not labeled, a supervised learning is not possible, and an unsupervised learning is required, that would find natural clustering of the data to groups, and map new data to these formed groups. The clustering algorithm which provides an improvement to the support vector machines is called support vector clustering (SVC) [14] and is highly used in industrial applications either when data is not labeled or when only some data is labeled as a preprocessing for a classification pass; the clustering method was published.…”

Section: B) Support Vector Machine (Svm)mentioning

confidence: 99%

“…The clustering algorithm which provides an improvement to the support vector machines is called support vector clustering (SVC) [14] and is highly used in industrial applications either when data is not labeled or when only some data is labeled as a preprocessing for a classification pass; the clustering method was published.…”

Section: B) Support Vector Machine (Svm)mentioning

confidence: 99%

“…The volume of communications is very small and it is not necessary to share the private raw data from which the local models are learnt. A PSO [8] and SVM [14]-based algorithm is proposed for combining the local models into a global detector in each node. The global detector that obtains information from other nodes obtains more accurate detection results than the local detector.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Intrusion Detection in Dynamic Distributed Network Using PSO and SVM Machine Learning Algorithms

2016

IJSR

View full text Add to dashboard Cite

Abstract:The number of computers connected to a network and the Internet is increasing with every day. This combined with the increase in networking speed has made intrusion detection a challenging process. System administrators today have to deal with larger number of systems connected to the networks that provide a variety of services. The challenge here is not only to be able to actively monitor all the systems but also to be able to react quickly to different events. Overall intrusion detection involves defense, detection, and importantly, reaction to the intrusion attempts. An intrusion detection system should try to address each of these issues to a high degree. So network security becomes more complex due to the arrival of large no. of new type of attacks and lack of dynamic system to detect new types of attack. In this paper we define the solution to frequently changing network environment. We propose Online Adaboost-based parameterized method. It contains two models, Local model and Global model. In the local model, online Gaussian mixture models (GMMs) and online Adaboost processes are used as weak classifiers. A global detection model is constructed by combining the local parametric model. This combination is achieved by using an algorithm based on support vector machines (SVM) and particle swarm optimization (PSO). This system is able to detect new types of attack when network environment changes. It gives high detection rate and low false alarm rate.

show abstract

Section: B) Support Vector Machine (Svm)mentioning

confidence: 99%

Section: B) Support Vector Machine (Svm)mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Intrusion Detection in Dynamic Distributed Network Using PSO and SVM Machine Learning Algorithms

2016

IJSR

View full text Add to dashboard Cite

show abstract

“…But for security practitioners, it is especially important, as a wide swath of security-sensitive applications build on machine learning technology, including intrusion detection systems, virus and worm detection systems, and spam filters [13,14,18,20,24].…”

Section: Introductionmentioning

confidence: 99%

Misleading Learners: Co-opting Your Spam Filter

Nelson

Barreno

Jack

et al. 2009

Machine Learning in Cyber Trust

123

View full text Add to dashboard Cite

Using statistical machine learning for making security decisions introduces new vulnerabilities in large scale systems. We show how an adversary can exploit statistical machine learning, as used in the SpamBayes spam filter, to render it useless-even if the adversary's access is limited to only 1% of the spam training messages. We demonstrate three new attacks that successfully make the filter unusable, prevent victims from receiving specific email messages, and cause spam emails to arrive in the victim's inbox. IntroductionApplications use statistical machine learning to perform a growing number of critical tasks in virtually all areas of computing. The key strength of machine learning is adaptability; however, this can become a weakness when an adversary manipulates the learner's environment. With the continual growth of malicious activity and electronic crime, the increasingly broad adoption of learning makes assessing the vulnerability of learning systems to attack an essential problem.The question of robust decision making in systems that rely on machine learning is of interest in its own right. But for security practitioners, it is especially important, as a wide swath of security-sensitive applications build on machine learning technology, including intrusion detection systems, virus and worm detection systems, and spam filters [13,14,18,20,24].Past machine learning research has often proceeded under the assumption that learning systems are provided with training data drawn from a natural distribution of inputs. However, in many real applications an attacker might have the ability to provide a machine learning system with maliciously chosen inputs that cause the system to infer poor classification rules. In the spam domain, for example, the adversary can send carefully crafted spam messages 1 Comp. Sci. Div., Soda Hall #1776, University of California, Berkeley, 94720-1776, USA 17and Reliability, DOI: 10.1007/978-0-387-88735-7_2, In Machine Learning in Cyber Trust: Security, Privacy, Reliability, eds. J. Tsai and P..Yu (eds.) Springer, 2009, pp. 17-51 18 that a human user will correctly identify and mark as spam, but which can influence the underlying machine learning system and adversely affect its ability to correctly classify future messages.We demonstrate how attackers can exploit machine learning to subvert the SpamBayes statistical spam filter. Our attack strategies exhibit two key differences from previous work: traditional attacks modify attack instances to evade a filter, whereas our attacks interfere with the training process of the learning algorithm and modify the filter itself; and rather than focusing only on placing spam emails in the victim's inbox, we also present attacks that remove legitimate emails from the inbox.We consider attackers with one of two goals: expose the victim to an advertisement or prevent the victim from seeing a legitimate message. Potential revenue gain for a spammer drives the first goal, while the second goal is motivated, for example, by an organiza...

show abstract

“…K-Means Clustering: Although previous work used neural networks for intrusion detection [20,21], we choose K-means clustering [22] to build the models of filesystem and network behavior. This decision is based on a smallscale (four-user) three-month user study on the network-based technique.…”

mentioning

confidence: 99%

Implicit User Re-authentication for Mobile Devices

Yazji

Chen

Dick

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Portable computers are used to store and access sensitive information. They are frequently used in insecure locations with little or no physical protection, and are therefore susceptible to theft and unauthorized access. We propose an implicit user re-authentication system for portable computers that requires no application changes or hardware modifications. The proposed technique observes user-specific patterns in filesystem activity and network access to build models of normal behavior. These are used to distinguish between normal use and anomalous use. We describe these automated model generation and user detection techniques, and explain how to efficiently implement them in a wireless distributed system composed of servers and battery-powered portable devices. The proposed system is able to distinguish between normal use and attack with an accuracy of approximately 90% every 5 minutes and consumes less than 12% of a typical laptop battery in 24 hours.

show abstract

Intrusion detection using neural networks and support vector machines

Cited by 561 publications

References 4 publications

Intrusion Detection in Dynamic Distributed Network Using PSO and SVM Machine Learning Algorithms

Intrusion Detection in Dynamic Distributed Network Using PSO and SVM Machine Learning Algorithms

Misleading Learners: Co-opting Your Spam Filter

Implicit User Re-authentication for Mobile Devices

Contact Info

Product

Resources

About