Detecting Novel Network Intrusions Using Bayes Estimators

By Daniel Barbará, Ningning Wu, Sushil Jajodia. SDM, 2001

369 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/63b23d8fac97dd64a878471b5d2b08514f511569

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “Audit data analysis and mining (ADAM) (Barbara et al., 2001) is an anomaly detection sys-tem which uses association mining to derive MCD features.”
A network intrusion detection system based on a Hidden Naïve Bayes multiclass classifier (2012, methodology): “ADAM relies on pseudo-Bayes estimators to estimate the prior and posterior probabilities of new attacks and then uses these probabilities to construct a Naïve Bayes classiﬁer for classifying normal and attack events without prior knowledge about new attacks (Barbara et al., 2001).”
A Survey of Privacy-Preserving Methods Across Vertically Partitioned Data (2008, neutral): “Outlier detection has been used to find uncommon sequences in gene data, to find fradulent transactions in credit card records, fraud discovery in mobile phones, to find intrusions from network traffic data[3, 19], etc.”
Anomaly detection: A survey (2009, methodology): “Multi-class classification based anomaly detection techniques assume that the training data contains labeled instances belonging to multiple normal classes [Stefano et al. 2000; Barbara et al. 2001b].”
Learning nonstationary models of normal network traffic for detecting novel attacks (2002, methodology): “To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.”
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection (2003, methodology): “Barbara used pseudo-Bayes estimators to enhance detection of novel attacks while reducing the false alarm rate as much as possible [5].”
SMOTEBoost: Improving Prediction of the Minority Class in Boosting (2003, background): “The challenge of detecting future attacks has led to an increasing interest in intrusion detection techniques based upon data mining [1, 2, 3, 4].”
What's hot and what's not: tracking most frequent items dynamically (2003, neutral): “This has been studied extensively in context of anomaly detection [5, 9, 17, 21].”
A Graphbased Framework for Multi-Task Multi-View Learning (2011, neutral): “If z ∈ N1 and z′ ∈ N1, kH(z, z ′) = kH1(z, z )−bk⃗H1(z, F )(I+bS)k⃗H1(F, z′) (3) If z ∈ N1 and z′ ∈ N2, kH(z, z ′) = bk⃗H1(z, F )(I + bS) k⃗H2(F, z ′) (4) If z ∈ N2 and z′ ∈ N1, kH(z, z ′) = bk⃗H2(z, F )(I + bS) k⃗H1(F, z ′) (5) If z ∈ N2 and z′ ∈ N2, kH(z, z ′) = kH2(z, z )−bk⃗H2(z, F )(I+bS)k⃗H2(F”
Mining intrusion detection alarms for actionable knowledge (2002, background): “Other related work comes from Barbar a et al., who use incremental data mining techniques to detect anomalous network trac patterns in real time [3, 5 ]. Lee and Stolfo use data mining for feature construction and training of classiers that detect intrusions [32].”
Data Mining for Network Intrusion Detection (2002, background): “These limitations have led to an increasing interest in intrusion detection techniques based upon data mining [2, 3, 4, 5, 6].”