Adaptive, Model-Based Monitoring for Cyber Attack Detection

By Alfonso Valdes, Keith Skinner. International Symposium on Recent Advances in Intrusion Detection, 2000

373 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/408e9bba656c9438231d87c5dbc366b773aa252f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, neutral): “Several researchers have adapted ideas from Bayesian statistics to create models for anomaly detection [29] [30] [31].”
The monitoring and early detection of Internet worms (2005, neutral): “For example, the “IDES” [13], “NIDES” [5] and “eBayes” [39] from SRI International; the anomaly intrusion detection method [15] based on “sequences”
Using Model-based Intrusion Detection for SCADA Networks (2006, background): “The EMERALD Bayes sensor is actually a coupled sensor, with a detector that represents models of misuse through conditional probability relations to observable evidence, and a service discovery component [10].”
Managing alerts in a multi-intrusion detection environment (2001, background): “Recent developments in this context suggest using Bayesian networks [20] and probabilistic alert correlation [21].”
Bayesian event classification for intrusion detection (2003, methodology): “In [24], a naı̈ve Bayesian network (shown in Figure 2) is employed to perform intrusion detection on network events.”
An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection (2003, background): “eBayes [5] models aggregate attributes over a short time window, such as number of open connections, ICMP error rate, number of ports accessed, and so on.”
Intrusion Detection in Unlabeled Data with Quarter-sphere Support Vector Machines (2004, background): “[BCJ+01, VS00 ]. In practice, however, it is difficult to obtain clean data to implement these approaches.”
Deep Learning Approach for Intelligent Intrusion Detection System (2019, result): “Later, [27] investigated the application of Naive Bayes network to ID and through detailed experimental analysis, they showed that Bayesian networks performed equally well and sometimes even better in ’U2R’ and ’Probe’ categories in comparison with the winning entries of KDDCup 99 challenge.”
Probabilistic Alert Correlation (2001, methodology): “This is a probe for 3 vulnerable ports on a single IP address in the protected network, and is detected by the system described in [ 2 ].”
Naive Bayes vs decision trees in intrusion detection systems (2004, methodology): “Valdes [14] uses a simple form of Bayes networks, called naive Bayes, composed of two levels: one root node which represents a session class (normal and di.erent kinds of attacks), and several leaf nodes, each of them contain a feature of a connection.”
Decision tree classifier for network intrusion detection with GA-based feature selection (2005, background): “INTRODUCTION Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.”
Anomaly detection: A survey (2009, methodology): “Several variants of the basic technique has been proposed for network intrusion detection [Barbara et al. 2001b; Sebyala et al. 2002; Valdes and Skinner 2000; Mingming 2000; Bronstein et al. 2001], for novelty detection in video surveillance [Diehl and Hampshire 2002], for anomaly detection in text ”