A Markov Chain Model of Temporal Behavior for Anomaly Detection

By Nong Ye. 2000

314 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/9a5be5ddb0fc59a89b466c0fffbf70be4e29ea95

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Anomaly Detection for Discrete Sequences: A Survey (2012, methodology): “Ye [54] proposed one such technique for k ¼ 1 .”
Outlier Detection for Temporal Data: A Survey (2014, methodology): “Ye [38] proposes a technique where a Markov model with k =1 is used.”
Outlier Analysis (2013, methodology): “Position outliers are computed using either Markovian techniques [332, 488], or rule-based systems [120, 488], which are equivalent.”
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection (2003, background): “Recent works such as [19] and [20] estimate parameters of a probabilistic model over the normal data and compute how well new data fits into the model.”
LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection (2016, methodology): “Time-series prediction models have been shown to be effective for anomaly detection by using the prediction error or a function of prediction error as a measure of the severity of anomaly (Hayton et al., 2007; Ma & Perkins, 2003; Ye et al., 2000).”
User re-authentication via mouse movements (2004, methodology): “Examples of methods that could be applied to monitor a user’s behavior indirectly include those that monitor system call traces [6, 10, 15, 22, 41], audit logs [18, 23, 24, 42, 44], program execution traces [13, 19, 25, 27, 31, 39] and call-stack data analysis [9].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, background): “Traditional anomaly-based intrusion detection systems (IDS) analyze system call traces from audit systems [37], [81], [130], [134].”
A signal analysis of network traffic anomalies (2002, methodology): “Methods for detecting intrusions include clustering [13], neural networks [14] and Markov models [15].”
Diagnosing network-wide traffic anomalies (2004, methodology): “Previous methods have principally relied on timeseries models to approximate normal trafﬁc [2,10,14] or have relied on building models of the data during a training period [24].”
Anomaly detection: A survey (2009, unknown): “2 Chow and Yeung [2002]”