scholarly journals Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity

2019 ◽  
Vol 9 (20) ◽  
pp. 4381
Author(s):  
Alvaro Parres-Peredo ◽  
Ivan Piza-Davila ◽  
Francisco Cervantes
Keyword(s):  
Intrusion Detection ◽  
Real Time ◽  
Network Traffic ◽  
Similarity Measures ◽  
Intrusion Detection Systems ◽  
The Real ◽  
Behavior Detection ◽  
Detection Systems ◽  
Real Time Traffic ◽  
Entire Network

Anomaly-based intrusion detection systems use profiles to characterize expected behavior of network users. Most of these systems characterize the entire network traffic within a single profile. This work proposes a user-level anomaly-based intrusion detection methodology using only the user’s network traffic. The proposed profile is a collection of TopK rankings of reached services by the user. To detect unexpected behaviors, the real-time traffic is organized into TopK rankings and compared to the profile using similarity measures. The experiments demonstrated that the proposed methodology was capable of detecting a particular kind of malware attack in all the users tested.

scholarly journals A System to automate the development of anomaly-based network intrusion detection model

2021 ◽  
Vol 2089 (1) ◽  
pp. 012006
Author(s):  
B Padmaja ◽  
K Sai Sravan ◽  
E Krishna Rao Patro ◽  
G Chandra Sekhar
Keyword(s):  
Machine Learning ◽  
Intrusion Detection ◽  
Real Time ◽  
Network Traffic ◽  
Intrusion Detection Systems ◽  
Network Intrusion Detection ◽  
Support Vector ◽  
The Internet ◽  
Detection Systems ◽  
Network Intrusion

Abstract Cyber security is the major concern in today’s world. Over the past couple of decades, the internet has grown to such an extent that almost every individual living on this planet has the access to the internet today. This can be viewed as one of the major achievements in the human race, but on the flip side of the coin, this gave rise to a lot of security issues for every individual or the company that is accessing the web through the internet. Hackers have become active and are always monitoring the networks to grab every possible opportunity to attack a system and make the best fortune out of its vulnerabilities. To safeguard people’s and organization’s privacy in this cyberspace, different network intrusion detection systems have been developed to detect the hacker’s presence in the networks. These systems fall under signature based and anomaly based intrusion detection systems. This paper deals with using anomaly based intrusion detection technique to develop an automation system to both train and test supervised machine learning models, which is developed to classify real time network traffic as to whether it is malicious or not. Currently the best models by considering both detection success rate and the false positives rate are Artificial Neural Networks(ANN) followed by Support Vector Machines(SVM). In this paper, it is verified that Artificial Neural Network (ANN) based machine learning with wrapper feature selection outperforms support vector machine (SVM) technique while classifying network traffic as harmful or harmless. Initially to evaluate the performance of the system, NSL-KDD dataset is used to train and test the SVM and ANN models and finally classify real time network traffic using these models. This system can be used to carry out model building automatically on the new datasets and also for classifying the behaviour of the provided dataset without having to code.

Performance Adaptation in Real-Time Intrusion Detection Systems

2002 ◽  
pp. 252-273 ◽  
Author(s):  
Wenke Lee ◽  
João B. D. Cabrera ◽  
Ashley Thomas ◽  
Niranjan Balwalli ◽  
Sunmeet Saluja ◽  
...  
Keyword(s):  
Intrusion Detection ◽  
Real Time ◽  
Intrusion Detection Systems ◽  
Detection Systems ◽  
Performance Adaptation

Abnormal File Access Behavior Detection Based on FPD: An Unsupervised Approach

2015 ◽  
Vol 713-715 ◽  
pp. 2212-2216 ◽  
Author(s):  
Xiao Bin Wang ◽  
Yong Jun Wang ◽  
Yong Lin Sun
Keyword(s):  
Information Security ◽  
Intrusion Detection ◽  
Training Data ◽  
Intrusion Detection Systems ◽  
Behavior Detection ◽  
Detection Systems ◽  
File Access ◽  
Information File ◽  
Unsupervised Approach ◽  
Modern Information

Information security is a great challenge for organizations in our modern information world. Existing security facilities like Firewalls, Intrusion Detection Systems and Antivirus are not enough to guarantee the security of information. File is an important carrier of information, which is the intent of quite a number of attackers. In this paper, we extend the FPD-based approach for detecting abnormal file access behaviors. We propose 3 approaches to calculate FPD values in the case of lacking training data, and we apply a k-means based unsupervised approach to distinguish between normal processes and abnormal ones. Experiment demonstrate that our unsupervised approach is still effective compared to the supervised case with training data.

Sign in / Sign up

Export Citation Format

Share Document