Service specific anomaly detection for network intrusion detection

By Christopher Krügel, Thomas Tøth, Engin Kirda. ACM Symposium on Applied Computing, 2002

391 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/770bae9ed688a84cfd2705a4ae4a11f5c9701f03

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

A survey of network anomaly detection techniques (2016, background): “Krügel et al. (2002) proposed a statistical processing unit for detecting anomalous network traffic, more specifically to detect the attacks which are rare such as R2L and U2R.”
DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, background): “Existing approaches rely on analysing single network packets [7] or clustering large numbers of packets [8], [9] to detected intrusions or compromised services.”
An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, background): “In another paper, Kruegel et al. [20] show that it is possible to find the description of a system that computes a payload byte distribution and combines this information with extracted packet header features .”
Anomalous Payload-Based Network Intrusion Detection (2004, result): “The work of Kruegel et al [8] describes a service-specific intrusion detection system that is most similar to our work.”
Detecting Unknown Network Attacks Using Language Models (2006, methodology): “Application of n-gram models for network-based IDS originated in the idea of using byte histograms of packet payloads for statistical tests of anomality ( 11 ).”
Bayesian event classification for intrusion detection (2003, methodology): “These approaches rely on models, or profiles, of the normal behavior of users [4, 8], applications [5, 26] and network traffic [10, 14, 15].”
A Learning-Based Approach to the Detection of SQL Attacks (2005, background): “This is an advantage of application-specific intrusion detection in general [11] and of web-based intrusion detection in particular [12].”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, background): “Anomaly-based detection of malicious HTTP-traffic has been studied for example in [24, 36, 37, 30, 6].”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, background): “In [19] Kruegel et al.”
Taxonomy and Survey of Collaborative Intrusion Detection (2015, methodology): “Monitors can locally apply signature-based as well as anomaly-based detection [Krugel et al. 2002] techniques.”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, background): “, [5-8]) have focused on payload-based anomaly detection.”
A survey on security issues in service delivery models of cloud computing (2011, background): “An often-ignored solution to accessibility vulnerabilities is to shut down unused services, keep patches updated, and reduce permissions and access rights of applications and users (Krugel et al., 2002).”
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems (2006, background): “high speed classification based on simple payload∗ statistics [15, 18, 28, 29].”
Polymorphic Blending Attacks (2006, methodology): “We believe this problem is common to other network anomaly IDS that use traffic statistics [15, 18].”
Anomaly detection: A survey (2009, methodology): “2000], detecting web-based attacks [Kruegel and Vigna 2003; Kruegel et al. 2002], and anomalous topic detection in text data [Allan et al.”
Casting out Demons: Sanitizing Training Data for Anomaly Sensors (2008, background): “Anomaly sensors include those that classify both network traffic content [13, 29] and sequences of system calls [22].”
Language models for detection of unknown attacks in network traffic (2007, methodology): “Application of n-gram models for network-based IDS originated in the idea of using byte (1-grams) histograms of packet payloads for statistical tests of abnormality [8; 13; 18].”