Proceedings of the 2004 ACM Symposium on Applied Computing 2004
DOI: 10.1145/967900.967992
|View full text |Cite
|
Sign up to set email alerts
|

Towards multisensor data fusion for DoS detection

Abstract: In our present work we introduce the use of data fusion in the field of DoS anomaly detection. We present DempsterShafer's Theory of Evidence (D-S) as the mathematical foundation for the development of a novel DoS detection engine. Based on a data fusion paradigm, we combine multiple evidence generated from simple heuristics to feed our D-S inference engine and attempt to detect flooding attacks. Our approach has as its main advantages the modeling power of Theory of Evidence in expressing beliefs in some hypo… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
2
1
1

Citation Types

0
61
0

Year Published

2005
2005
2016
2016

Publication Types

Select...
7
1
1

Relationship

0
9

Authors

Journals

citations
Cited by 91 publications
(61 citation statements)
references
References 12 publications
0
61
0
Order By: Relevance
“…Within the first group are Gaussian models or Bayesian networks (Siaterlis andMaglaris, 2004, 2001). One of the boundary-based classifiers is the well-known kNN, modified for the case of one-class classification (Byers and Raftery, 1998;Eskin et al, 2002), or support vector machines (Ratsch et al, 2002;Tax and Duin, 2004).…”
Section: One-class Classificationmentioning
confidence: 99%
“…Within the first group are Gaussian models or Bayesian networks (Siaterlis andMaglaris, 2004, 2001). One of the boundary-based classifiers is the well-known kNN, modified for the case of one-class classification (Byers and Raftery, 1998;Eskin et al, 2002), or support vector machines (Ratsch et al, 2002;Tax and Duin, 2004).…”
Section: One-class Classificationmentioning
confidence: 99%
“…D-S theory has been previously used in the intrusion detection field to enhance detection accuracy [3], [15], [16]. In [15], the problem of discovering anomalies in large-scale networks based on the data fusion of heterogeneous monitors is considered.…”
Section: Related Workmentioning
confidence: 99%
“…Data fusion can be defined as the process of collecting information from multiple and heterogeneous sources, and combining this to obtain a more accurate final result [3]. As we have shown in previous work [1], [2], Dempster-Shafer (D-S) theory of evidence is a good candidate for this purpose because it does not require a priori knowledge of the system, and provides the ability to manage uncertainty.…”
mentioning
confidence: 99%
“…Context information fusion concerns with how this contextual information gathered by sensors can be processed to increase its relevance. Contextual information fusion can be commonly used in detection and classi cation tasks, such as robotics and military applications [39], intrusion detection [40] and Denial of Service (DoS) detection [41].…”
Section: Classi Cation Of Context Information Fusionmentioning
confidence: 99%