Name
Abstract | ||
|---|---|---|
Misuse-based intrusion detection systems alone cannot cope with the dynamic nature of the security threats faced today by organizations globally. Variants of malware and exploits are emerging on the global canvas at an ever-increasing rate. There is a need to automate their detection by observing their malicious footprints over network streams. In this paper we evaluate a proposed technique to measure the relative similarity or level of maliciousness between different categories of malicious network streams captured by honeynets. This is measured by quantifying areas of analogous information or entropy between incoming network streams and reference malicious samples. Machine learning methods are used to quickly cluster similar groups of streams from the datasets. This technique is then evaluated using a large dataset and the correctness of the classifier is verified by using `area under the receiver operating characteristic curves'(ROC AUC) measures across various string metric-based classifiers. |
Year | DOI | Venue |
|---|---|---|
2012 | 10.1109/GLOCOM.2012.6503226 | Global Communications Conference |
Keywords | Field | DocType |
invasive software,learning (artificial intelligence),honeynets,machine learning method,malicious footprints,malicious network streams,malware,misuse based intrusion detection system,receiver operating characteristic curves measures,security threats,string metric based classifiers | Data mining,Receiver operating characteristic,Computer science,Correctness,Exploit,Malware,STREAMS,String metric,Classifier (linguistics),Intrusion detection system | Conference |
ISSN | ISBN | Citations |
1930-529X E-ISBN : 978-1-4673-0919-6 | 978-1-4673-0919-6 | 4 |
PageRank | References | Authors |
0.43 | 5 | 5 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Fahim H. Abbasi | 1 | 5 | 1.12 |
| Richard J. Harris | 2 | 71 | 11.37 |
| Giovanni Moretti | 3 | 37 | 15.81 |
| A. Haider | 4 | 35 | 4.20 |
| Nafees Anwar | 5 | 4 | 0.43 |