Outside the Closed World: On Using Machine Learning for Network Intrusion Detection

By Robin Sommer, Vern Paxson. 2010

2,002 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “Such a scenario is commonly encountered in anomaly-based network intrusion detection [19].”
Unsolved Problems in ML Safety (2021, methodology): “For instance, ML could be used to detect intruders [114, 165] or impersonators [89].”
Evading Classifiers by Morphing in the Dark (2017, background): “Numerous innovative applications of machine learning in security contexts, especially for detection of security violations, have been discussed in the literature [19, 22, 28].”
FeatureSmith: Automatically Engineering Features for Malware Detection by Mining the Security Literature (2016, background): “These explanations refer to abstract concepts that human analysts associate with malware behavior and provide semantic insights into the operation of the malware detector, which is key for operational deployments of such detectors [41].”
Towards a Standard Feature Set for Network Intrusion Detection System Datasets (2021, background): “It is believed that the lack of reliable evaluation methods has caused a gap between the extensive academic research produced and the practical deployment of ML-based NIDS models in production networks [14].”
Scalable Optimization of Randomized Operational Decisions in Adversarial Classification Settings (2015, methodology): “Extensive experiments demonstrate the efficacy of our approach.”
Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers (2014, background): “Several studies have examined attacks on specific MLbased applications, from email spam detection [12] to network intuition detection [37, 40, 44] to malicious (PDF) file classification [5, 25, 41] and malware detection [21].”
Deep Reinforcement Learning (2018, methodology): “tton and Barto(2018). SECURITY There is a long history applying machine learning (ML) techniques to system security issues, e.g., Chandola et al.(2009) survey ML techniques for anomaly detection, and,Sommer and Paxson (2010) discuss issues in using ML techniques for network intrusion detection. Adve”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, background): “Ps. In contrast, our work identiﬁes experimental settings that are misleading regardless of the adopted metrics, and that remain incorrect even if the right metrics are used (§4.4). Sommer and Paxson [47] discuss challenges and guidelines in ML-based intrusion detection; Rossow et al. [44] discuss b”
Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection (2020, background): “As identified by Sommer and Paxson in [40], there has”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, methodology): “Firstly, the ML models are applied to locate such activities that may not be previously seen [667].”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “And in the space of intrusion detection, there is a similar story of research on detecting intrusions [137, 138, 54, 47] (and again, even using neural networks [71]) and evading intrusion detection [120, 30].”
Explaining Black-box Android Malware Detection (2018, background): “[5], [10], [18], Sommer and Paxson [16] have more generally questioned the suitability of black-box machine-learning approaches to computer security.”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “In other words, they should take into account how intrusive activities can evolve, and capture characteristics that are invariant with respect to such an evolution.”
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage (2019, background): “However, these methods also have significant detection error and suffer from generating too many false alerts [58], [34].”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “It is important to realize that the component protection techniques presented in this section are in practice often combined with more generic pattern recognition techniques discussed in Section IV [1], [26], [65], for example, hardware and virtualization solutions might be used to achieve a clean v”
A Survey of Random Forest Based Methods for Intrusion Detection Systems (2018, background): “However, this is still challenging, because technology produces a great variation in behaviours, making it difficult to establish a “normal” pattern, which leads to high false-positive rates (Sommer and Paxson 2010).”
Optimal randomized classification in adversarial settings (2014, background): “Among these, there has been considerable interest in using machine learning techniques for security, for example as a means for detecting intrusions, separating spam email from good, and distinguishing benign and malicious files [21].”