Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems

By Roberto Perdisci, Guofei Gu, Wenke Lee. 2006

249 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Security Evaluation of Pattern Classifiers under Attack (2014, background): “01 as suggested in [24], so that only γ has to be chosen.”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, neutral): “Support Vector Machines (SVMs) are among the most successful techniques that have been applied for this purpose [28, 54].”
Towards Making Systems Forget with Machine Unlearning (2015, background): “This also aligns with the fact that one-class machine learning is robust to mimic attacks [57].”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “As discussed in [47, 18, 31], a generic n-gram version of PAYL may help to improve accuracy and the hardness of evasion.”
A Survey of Recent Trends in One Class Classification (2009, methodology): “OSVMs have been successfully applied in a wide variety of application domains such as Handwritten Digit Recognition [1][2][19], Information Retrieval [20], Face Recognition Applications [28][37], Medical Analysis [38], Bioinformatics [39][40], Spam Detection [41], AnomalyDetection [42][43], Machine ”
A novel hybrid intrusion detection method integrating anomaly detection with misuse detection (2014, unknown): “The 1-class SVM also considers a trade off between maximizing the distance of the hyper plane from the origin and the fraction of data instances contained in the separated region (Perdisci, Gu, & Lee, 2006).”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “One-class SVMs are popular nonlinear models, which have been successfully applied to detecting novel intrusions [118], [119], [120], [121], [122], [123].”
Detecting algorithmically generated malicious domain names (2010, methodology): “Statistical and learning techniques have been employed by various studies for prediction [10, 25, 13].”
Evade Hard Multiple Classifier Systems (2009, methodology): “The classifier ensemble approach has been explicitly investigated in the literature of IDSs, as an alternative to the approach based on a “monolithic” classifier [2, 6].”
Multiple classifier systems for robust classifier design in adversarial environments (2010, background): “Recently, it has also been argued that MCSs allow to improve classifier robustness in several adversarial classification tasks, based on the intuitive motivation that an adversary has to evade more than one classifier to make the whole ensemble ineffective [29, 52,44,46,47].”
One-class classification: taxonomy of study and review of techniques (2013, unknown): “…2005); Collision Detection (Quinlan et al ., 2003); Anomaly Detection (Nguyen, 2002; Li et al ., 2003; Tran et al ., 2004; Yilmazel et al ., 2005; Perdisci et al ., 2006; Zhang et al ., 2007); Intrusion Detection (Evangelista et al ., 2005; Giacinto et al ., 2005; Luo et al ., 2007); Credit…”
Multiple Classifier Systems for Adversarial Classification Tasks (2009, background): “Few authors proposed the use of MCSs with the explicit goal of improving the hardness of evasion (see for instance [2]).”
Machine learning for power system disturbance and cyber-attack discrimination (2014, background): “Machine learning has distinguished itself as a discriminator of malicious and anomalous events in intrusion detection for traditional cyber security networks [32] [33] [34].”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, methodology): “In order to solve this problem, we proposed a new technique to extract the features from the payload that is similar to the 2-gram technique [26].”
Multiple Classifier Systems under Attack (2010, methodology): “Another motivation was proposed by several authors: using many classifiers would improve robustness because it would require the adversary to evade all the individual classifiers, or at least more than one of them, to evade the whole system [4, 2, 11].”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, methodology): “[117] show that an ensemble composed by 11 classifiers can significantly outperform the single best classifier (DR=99.”