Learning nonstationary models of normal network traffic for detecting novel attacks

By Matthew V. Mahoney, Philip Ka-Fai Chan. Knowledge Discovery and Data Mining, 2002

421 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/7d63035336b8af44a4e027cf72e376ff292793a1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Classifier evaluation and attribute selection against active adversaries (2010, background): “Problems ranging from intrusion detection (Mahoney and Chan 2002) to fraud detection (Fawcett and Provost 1997) need to be able to cope with adaptive malicious adversaries.”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, background): “In their study of the DARPA/Lincoln Laboratory intrusion dataset, Mahoney and Chan [2003] demonstrate that spurious artifacts in training data can cause an IDS to learn to distinguish normal from intrusion traffic based on those artifacts rather than relevant features.”
Can machine learning be secure? (2006, background): “Outlier detection is the task of identifying anomalous data and is a widely used paradigm in fault detection [40], intrusion detection [23], and virus detection [33, 34].”
Statistical approaches to DDoS attack detection and response (2003, background): “Researchers at Florida Institute of Technology have created an intrusion detection system (IDS) that is nonstationary and models probabilities based on time since the last event rather than on average rate [6].”
Adversarial classification (2004, neutral): “Copyright 2004 ACM 1-58113-888-1/04/0008 ...$5.00.”
An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, methodology): “Mahoney et al. [41] [42] [43] presented several methods that address the problem of detecting anomalies in the usage of network protocols by inspecting packet headers.”
A Learning-Based Approach to the Detection of SQL Attacks (2005, methodology): “As another example, in [15] the authors use statistical analysis of network traﬃc to learn the normal behavior of network-based applications.”
Anomaly detection: A survey (2009, methodology): “Association rule mining based techniques have been used for network intrusion detection [Mahoney and Chan 2002; 2003; Mahoney et al. 2003; Tandon and Chan 2007; Barbara et al. 2001a; Otey et al. 2003], system call intrusion detection [Lee et al.”
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection (2003, neutral): “One approach uses a prediction model obtained by training decision trees over normal data [2], while others use neural networks to obtain the model [15] or non-stationary models [16] to detect novel attacks.”
A review of novelty detection (2014, methodology): “This has been applied to network intrusion and web-based attack detection [117,140–142].”
Bounding an Attack ’ s Complexity for a Simple Learning Model (2006, methodology): “Outlier detection is the task of identifying anomalous data and is a widely used paradigm in intrusion detection [7] and virus detection [13, 14].”
Anomalous Payload-Based Network Intrusion Detection (2004, methodology): “Some of the systems reconstruct the network packets and extract features that describe the higher level interactions between end hosts like MADAMID [9], Bro [15], EMERALD [18], STAT [24], ALAD [13], etc.”
Network traffic anomaly detection based on packet bytes (2003, neutral): “Attacker5 may de116erate1y man1pu1ate netw0rk pr0t0c015 t0 h1de an attack fr0m an 1mpr0per1y c0ded 1ntru510n detect10n 5y5tem (1D5) m0n1t0r1n9 the app11cat10n 1ayer [3, 11].”
Data preprocessing for anomaly based network intrusion detection: A review (2011, background): “Mahoney and Chan (2002b) built on PHAD by creating a new component called Application Layer Anomaly Detector (ALAD).”
Comparing Anomaly Detection Techniques for HTTP (2007, neutral): “In spite of these limitations, Wang and Stolfo [23], Mahoney [24], and Mahoney and Chan [25] Vargiya and Chan [26] used one or both of these data sets for testing their IDSs, at least a portion of which were for protecting web servers.”