An Internal Intrusion Detection and Protection System by Using Data Mining and Forensic Techniques

Leu, Fang−Yie; Tsai, Kun-Lin; Hsiao, Yi-Ting; Yang, Chao-Tung

doi:10.1109/jsyst.2015.2418434

Cited by 32 publications

(24 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Thus, analyzing electronic evidence in internet pyramid selling becomes very important and crucial. Many researchers analyzed the electronic evidence analysis process of internet pyramid selling, but there are few data forensics models [6,7].…”

Section: Realted Workmentioning

confidence: 99%

A Method of Mining Key Accounts from Internet Pyramid Selling Data

2019

Teh. vjesn.

View full text Add to dashboard Cite

Internet pyramid selling causes great harm and has difficulty in obtaining evidence. As most of internet pyramid selling often uses virtual coins to complete cash settlement, criminals can exchange virtual coins by controlling visual accounts to transfer funds illegally. The purpose of the work is to mine the key accounts and build evidence chain of personnel and funds. In order to deal with a large number of transaction data, we characterize the virtual currency trading data, which is divided into seven transaction characteristics. The key accounts are these outliers which have too prominent trading behaviour. So we use positive samples to train One Class Support Vector Machine (OCSVM) classification to find trading behaviours' boundary and detect outliers in classification. Then, the correlation between member's information and pyramid selling hierarchical relationship can also be obtained by further linking the trading behaviour of key accounts. Finally, we can screen out the virtual accounts directly controlled by the pyramid selling organization, analyse the flow of funds, investigate and obtain evidence on amount of money involved in pyramid selling. The experimental results show that the classification model cannot only establish the normal model for account transfer behaviour, but also effectively identify abnormal transfer behaviour, thus improving efficiency of investigation and evidence collection for economic investigation departments.

show abstract

Section: Realted Workmentioning

confidence: 99%

A Method of Mining Key Accounts from Internet Pyramid Selling Data

2019

Teh. vjesn.

View full text Add to dashboard Cite

show abstract

“…An application‐layer IIDPS is developed in the works of Leu et al using data mining and forensic techniques for detection of insider attacks. Operating system–level system calls (SC) are extracted from computer usage history to mine SC patterns of a normal user.…”

Section: Related Workmentioning

confidence: 99%

“…As shown in Figure , if PLIDS is used along with ALIDS, which has complexity O ( n 6 ), then for PLIDS, at τ =0,

T_{R}^{+} = 100

% (Figure 6) for which all the intrusions will be detected by PLIDS and ALIDS will remain idle. In this case, the total number of instructions executed will be (2.5+0)×10 6 =2.5×10 6 .…”

Section: Asymptotic Performance Comparisons and Computational Gainsmentioning

confidence: 99%

“…If P ( D 1 )≠ P ( D 2 )≠ P ( D 3 ), then from Figure , P ( D 1 ) is equal to the detection probability of PLIDS and for τ =0.01, it is 90.5%. P ( D 2 ) is equal to the detection probability of NLIDS, which is 98.516%, and P ( D 3 ) is equal to the detection probability of ALIDS, which is 94.29%. Putting these values in gives P IDS =0.99991950042≈1, ie, P IDS again follows P IDS ⟶100% for unequal detection rates of multilayer cascade connected IDSs.…”

Section: Convergence Of Detection Probabilitymentioning

confidence: 99%

See 1 more Smart Citation

Convergence of detection probability, computational gains, and asymptotic analysis of an algorithm for physical‐layer intrusion detection system

Yousaf

Loan

Babiceanu

et al. 2018

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Asymptotic analysis of an algorithm is crucial for practical engineering design. It provides important information about the performance of an algorithm in terms of time complexity, space complexity, and input scale. Based on these performance metrics, engineers can utilize available resources for efficient implementation of the algorithm. In this paper, asymptotic analysis is performed for an algorithm designed for a physical‐layer intrusion detection system (PLIDS). The algorithm first solves Fredholm integral equation of the first kind using Tikhonov regularization. Then, the solution of this equation is used to design a criterion for detection of smart jamming attacks at physical‐layer of the TCP/IP protocol stack. The proposed detection criterion works in constant time. The asymptotic performance metric derived for PLIDS gives insights about its algorithmic behavior. Convergence of detection probability and computational gain of using PLIDS, over higher‐layer intrusion detection systems, are also explained. Finally, apart from asymptotic performance, the detection performance metrics of the PLIDS are also discussed.

show abstract

“…Pessoas ganham benefícios e companhias geram lucro gerenciando seus recursos e transações através da rede, criando maiores oportunidades para usuários maliciosos roubarem informações pessoais e secretas. SegundoLeu et al (2015), nos últimos anos diversas estatísticas mostram um número crescente de invasões reportadas no Symantec Global Internet Security Threat Report.Um sistema de detecção de intrusão (IDS -Intrusion Detection System) é um sistema utilizado para monitorar as atividades de outro sistema ou de uma rede, procurando por atividades maliciosas e produzindo mensagens de alerta para a estação de controle, conformeTan et al (2014). Um IDS consiste de dois componentes: detecção por assinaturas e detecção por anomalias.…”

unclassified