"Why 6?" Defining the operational limits of stide, an anomaly-based intrusion detector

By Kymie M. C. Tan, Roy A. Maxion. 2002

176 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Poisoning behavioral malware clustering (2014, background): “setup slightly simplifies our attack, previous work has already shown that creating artificial q-grams of system calls, and similarly the use of different MIST levels, is not a challenge for an attacker [29, 30, 34], especially if she has full control over the behavior, as in the case of malware.”
Undermining an Anomaly-Based Intrusion Detection System Using Common Exploits (2002, background): “This coverage map for stide, although previously presented in [19], is shown again here as an aid to the reader’s intuition for the coverage map’s essential role in the subversion scheme.”
Hiding Intrusions: From the Abnormal to the Normal and Beyond (2002, background): “Note that the true external penetrator may be either an outsider with no connection to the organization that owns or controls the system being attacked or it may be someone associated with the organization who is not authorized to use the system.”
Automatic analysis of malware behavior using machine learning (2011, unknown): “The embedding using q -grams in our approach rests on work on host-based intrusion detection (e.g., [19,24,33]) which is known to suffer from evasion and mimicry attacks (e.g., [63,64,68]).”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, background): “demonstrated the amount of effort it can require to understand a single parameter’s impact, even with an conceptually simple anomaly detection system [56] .”
Language models for detection of unknown attacks in network traffic (2007, methodology): “Previous results in natural language processing and hostbased IDS indicate that the optimal n-gram length may vary for di erent applications and datasets [19; 24; 51; 52].”
Anomaly detection of web-based attacks (2003, background): “The number six seems to have a particular relevance to the field of anomaly detection [32].”