Anagram: A Content Anomaly Detector Resistant to Mimicry Attack

By Ke Wang, Janak J. Parekh, Salvatore J. Stolfo. 2006

354 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Anomaly & Outlier Detection, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Anomaly & Outlier Detection

In Signal Processing

Citations in the corpus

Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “, [37], [38], [39], [40], which uses n-grams, or short byte sequences, as basic features.”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “Previous work on evasion attacks has mainly investigated the vulnerability of supervised [7], [11], [20] and unsupervised learning techniques [21], [22] in different applications, including spam filtering [5], [23], [24], intrusion detection [25], and biometric recognition [1], [2].”
Security analysis of online centroid anomaly detection (2010, methodology): “The centroid anomaly detection is a very simple method which has been widely used in computer security applications (e.g., Forrest et al., 1996; Warrender et al., 1999; Wang and Stolfo, 2004; Rieck and Laskov, 2006; Wang et al., 2006; Rieck and Laskov, 2007).”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “ for example, on spam detection [73] (this uses an l 0-constrained attack model but provides a realistic justication for it), malware detection [74], and securing network intrusion detection systems [75, 76]. As described in the review by Biggio and Roli [77], the perturbation defense literature has”
Online Anomaly Detection under Adversarial Impact (2010, result): “…carried out in this section are intended to verify that the results of our analysis given in the previous sections hold true for real data used in security applications, e.g., in intrusion detection (Hofmeyr et al., 1998; Wang and Stolfo, 2004; Wang et al., 2006; Rieck and Laskov, 2007).”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “In essence, Anagram is like a content matching scheme.”
Casting out Demons: Sanitizing Training Data for Anomaly Sensors (2008, methodology): “Anagram (V is the voting threshold; see section 2)”
Toward Supervised Anomaly Detection (2014, methodology): “…parameter value ν = 1 , which corresponds to classical centroid-based anomaly detection (e.g., Shawe-Taylor & Cristianini, 2004), such that results directly transfer to anomaly detectors as Anagram (Wang et al., 2006), McPad (Perdisci et al., 2009) and TokDoc (Krueger, Gehl, Rieck, & Laskov, 2010).”
On the infeasibility of modeling polymorphic shellcode (2007, background): “Anagram [21] caches known benign n-grams extracted from normal content in a fast hash map and compares ratios of seen and unseen grams to determine normality.”
Machine learning in adversarial environments (2010, methodology): “Several methods have been proposed for detecting anomalous network packets or to automatically generate signatures that are closely related to machine learning methods, e.g. one-class classification or naive Bayes (Wang and Stolfo 2004; Wang et al. 2006; Newsome et al. 2005; Li et al. 2006).”
Comprehensive Analysis and Detection of Flash-Based Malware (2016, background): “Finally, as Gordon’s detector is based on machine learning, it may be vulnerable to mimicry attacks [18, 46, 47].”
Language models for detection of unknown attacks in network traffic (2007, methodology): “, in which a Bloom lter is applied for storage of high-order ngrams of normal and malicious packet payloads [25].”
Adaptive Anomaly Detection via Self-calibration and Dynamic Updating (2009, methodology): “Anomaly Detection (AD) sensors are becoming increasingly p opular: host-based [24] and network-based [16, 17, 21, 25, 30] intrusion detection s ystems rely heavily on AD components to maintain their high detection rates and minim ize the false positives even when other, non-AD sensors are involved i”
Forschungsberichte der Fakultät IV – Elektrotechnik und Informatik C UJO : Efficient Detection and Prevention of Drive-by-Download Attacks (2010, methodology): “It thus su ces to only store the q-grams contained in each report x for sparsely representing the vector φ(x), for example, using e cient data structures such as Tries [10] or Bloom lters [20].”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, methodology): “Wang et al. also proposed ANAGRAM [37], an anomaly detector based on n - gram analysis that uses a diﬀerent approach for modeling the traﬃc, compared to PAYL.”