Anomalous Payload-Based Network Intrusion Detection

By Ke Wang, Salvatore J. Stolfo. 2004

958 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Security Evaluation of Pattern Classifiers under Attack (2014, methodology): “Here we assume that an anomaly-based IDS is being designed, using a one-class n-SVM classifier with a radial basis function (RBF) kernel and the feature vector representation proposed in [49].”
Query Strategies for Evading Convex-Inducing Classifiers (2010, background): “The adversary wishes to optimize A over the negative class, X − f ; e.g. , the spammer wants to send spam that will be classiﬁed as normal email ( ' ' ) rather than as spam ( ' + ' ).”
Security analysis of online centroid anomaly detection (2010, methodology): “The centroid anomaly detection is a very simple method which has been widely used in computer security applications (e.g., Forrest et al., 1996; Warrender et al., 1999; Wang and Stolfo, 2004; Rieck and Laskov, 2006; Wang et al., 2006; Rieck and Laskov, 2007).”
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems (2006, methodology): “Furthermore, it is possible to use signature-based IDS in order to filter the extracted traffic by removing the known attacks, thus further reducing the number of attack patterns possibly present in the dataset.”
Intrusion detection by machine learning: A review (2009, neutral): “…GA No. of articles 1 6 7 3 2 4 1 2 Chimphlee et al. (2006) Bouzida et al. (2004), Eskin et al. (2002), Li and Guo (2007), Liao and Vemuri (2002), Wang and Stolfo (2004), Wang et al. (2004) Chen et al. (2005), Eskin et al. (2002), Heller et al. (2003), Peddabachigari et al. (2004), Tian et al.…”
Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection (2018, methodology): “For example, the PAYL IDS which models simple histograms of packet content [18] or the kNN algorithm [19].”
Autoencoder-based feature learning for cyber security applications (2017, background): “In the literature, a wide range of feature sets have been used to identify anomaly intrusions and malware [5, 6, 7].”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, methodology): “[459] Unsupervised Centroid model (Offline) KDD Cup [257] & CUCS Payload of TCP traffic -2 weeks training data -3 weeks testing data -Inside network TCP data only -Incremental learning DR w/ payload of a packet: 58.”
A Survey of Malware Detection Techniques (2007, background): “Wang and Stolfo also evaluated their technique on a Columbia University Computer Science (CUCS) dataset.”
Machine learning in adversarial environments (2010, methodology): “As an illustration of their taxonomy, the authors show how it can guide the development of attacks against SpamBayes, a popular spam filter.”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “The incremental aspects of this work are in a similar vein to other online intrusion recognition techniques [126], [127], [128], [129], [130], [131], [132], which, given a batch of training points Xt at time t, aim to update the prior for time t + 1 in terms of the posterior for time t, so that Pt+1”
Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software (2005, background): “, many non-ASCII bytes in a text-based protocol) [58].”
GenProg: A Generic Method for Automatic Software Repair (2012, background): “[ 61 ] , and Wang and Stolfo [ 62 ] , could be incorporated directly into our proposed closed - loop repair system .”