OCPAD: One class Naive Bayes classifier for payload based anomaly detection

Swarnkar, Mayank; Hubballi, Neminath

doi:10.1016/j.eswa.2016.07.036

Cited by 84 publications

(43 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…An independent set of features of the observed traffic like, status flags, protocol, latency, are used to forecast the probability of traffic being normal or otherwise. Being simple and easy to implement an algorithm, various IDSs have employed an NB classifier to identify anomalous traffic [108][109][110][111]. It requires very few samples for training [112] and can classify in both binary and multi-label classification.…”

Section: Naive Bayes (Nb) Classifiermentioning

confidence: 99%

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions

et al. 2020

View full text Add to dashboard Cite

The Internet of Things (IoT) is poised to impact several aspects of our lives with its fast proliferation in many areas such as wearable devices, smart sensors and home appliances. IoT devices are characterized by their connectivity, pervasiveness and limited processing capability. The number of IoT devices in the world is increasing rapidly and it is expected that there will be 50 billion devices connected to the Internet by the end of the year 2020. This explosion of IoT devices, which can be easily increased compared to desktop computers, has led to a spike in IoT-based cyber-attack incidents. To alleviate this challenge, there is a requirement to develop new techniques for detecting attacks initiated from compromised IoT devices. Machine and deep learning techniques are in this context the most appropriate detective control approach against attacks generated from IoT devices. This study aims to present a comprehensive review of IoT systems-related technologies, protocols, architecture and threats emerging from compromised IoT devices along with providing an overview of intrusion detection models. This work also covers the analysis of various machine learning and deep learning-based techniques suitable to detect IoT systems related to cyber-attacks.

show abstract

Section: Naive Bayes (Nb) Classifiermentioning

confidence: 99%

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions

et al. 2020

View full text Add to dashboard Cite

show abstract

“…(Pimentel et al, 2014;Einarsdóttir et al, 2016;Kafkas and Montaldi, 2018). Therefore, in order to evaluate the performance of the classifiers, the recall of the normal class is commonly maximized (Swarnkar and Hubballi, 2016;Luca et al, 2016). Formally, the training set is generated only from P (x|C = N ).…”

Section: Novelty Detectionmentioning

confidence: 99%

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

2019

View full text Add to dashboard Cite

In recent years, a variety of research areas have contributed to a set of related problems with rare event, anomaly, novelty and outlier detection terms as the main actors. These multiple research areas have created a mix-up between terminology and problems. In some research, similar problems have been named differently; while in some other works, the same term has been used to describe different problems. This confusion between terms and problems causes the repetition of research and hinders the advance of the field. Therefore, a standardization is imperative. The goal of this paper is to underline the differences between each term, and organize the area by looking at all these terms under the umbrella of supervised classification. Therefore, a one-to-one assignment of terms to learning scenarios is proposed. In fact, each learning scenario is associated with the term most frequently used in the literature. In order to validate this proposal, a set of experiments retrieving papers from Google Scholar, ACM Digital Library and IEEE Xplore has been carried out.

show abstract

“…McPAD [29] detects HTTP attacks using multiple one-class SVMs, whose outputs are combined to make a final prediction. Recently, Swarnkar [30] adopted a one-class Multinomial Naive Bayes classifier and used likelihood of each short sequences occurrence in payloads of known benign packets as a measure to derive the degree of maliciousness of a packet.…”

Section: Constant Detectionmentioning

confidence: 99%

An adaptive system for detecting malicious queries in web attacks

Dong

Zhang

et al. 2018

Sci. China Inf. Sci.

View full text Add to dashboard Cite

Web request query strings (queries), which pass parameters to the referenced resource, are always manipulated by attackers to retrieve sensitive data and even take full control of victim web servers and web applications. However, existing malicious query detection approaches in the current literature cannot cope with changing web attacks with constant detection models. In this paper, we propose AMODS, an adaptive system that periodically updates the detection model to detect the latest unknown attacks. We also propose an adaptive learning strategy, called SVM HYBRID, leveraged by our system to minimize manual work. In the evaluation, an up-to-date detection model is trained on a ten-day query dataset collected from an academic institute's web server logs. Our system outperforms existing web attack detection methods, with an F-value of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive Learning (SVM AL) method. The malicious queries obtained can be used to update the Web Application Firewall (WAF) signature library.

show abstract

OCPAD: One class Naive Bayes classifier for payload based anomaly detection

Cited by 84 publications

References 9 publications

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions

A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions

Analyzing rare event, anomaly, novelty and outlier detection terms under the supervised classification framework

An adaptive system for detecting malicious queries in web attacks

Contact Info

Product

Resources

About