Constructing VEGGIE: Machine Learning for Context-Sensitive Graph Grammars

Ates, K.; Zhang, Kang

doi:10.1109/ictai.2007.59

Cited by 13 publications

(11 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is achieved by mining recurring behavioral patterns from execution traces using VEGGIE with SubdueGL [4,5], a Minimum Description Length (MDL)-based compression algorithm. The inferred graph grammar and a syntactic parse tree visually represent reused structures found.…”

Section: Related Workmentioning

confidence: 99%

“…Overgeneralization occurs when the inference process produces a grammar whose language is larger than the unknown language. The use of negligible items results in an unnecessarily evolutionary GA-based [42] L A g t s [ 8] heuristic ALLiS [13] Inductive CYK [36] ABL [54] MDL e-GRIDS [38] CDC [10] VEGGIE [4,5] Eiland et al [17] greedy search ADIOS CDC Incremental parsing [3,44] Sequitur [37] GraphViz [45,46] clustering EMILE [1] C D C large grammar. To limit the impact of over-generalization, it is recommended to also use a set of negative examples.…”

Section: Grammar Inferencementioning

confidence: 99%

See 1 more Smart Citation

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Luh

Schramm

Wagner

et al. 2018

J Comput Virol Hack Tech

View full text Add to dashboard Cite

Targeted attacks on IT systems are a rising threat to the confidentiality of sensitive data and the availability of critical systems. The emergence of Advanced Persistent Threats (APTs) made it paramount to fully understand the particulars of such attacks in order to improve or devise effective defense mechanisms. Grammar inference paired with visual analytics (VA) techniques offers a powerful foundation for the automated extraction of behavioral patterns from sequential event traces. To facilitate the interpretation and analysis of APTs, we present SEQUIN, a grammar inference system based on the Sequitur compression algorithm that constructs a context-free grammar (CFG) from string-based input data. In addition to recursive rule extraction, we expanded the procedure through automated assessment routines capable of dealing with multiple input sources and types. This automated assessment enables the accurate identification of interesting frequent or anomalous patterns in sequential corpora of arbitrary quantity and origin. On the formal side, we extended the CFG with attributes that help describe the extracted (malicious) actions. Discovery-focused pattern visualization of the output is provided by our dedicated KAMAS VA prototype.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Grammar Inferencementioning

confidence: 99%

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Luh

Schramm

Wagner

et al. 2018

J Comput Virol Hack Tech

View full text Add to dashboard Cite

show abstract

“…The terminal nodes represent the invoked methods in the given program. We can perform two types of behavior verification: (1) verifying the acceptable call sequences in the scenario; (2) detecting illegal behaviors or security related activities. Suppose in a application, object A does not have the authority to access methods on object C, thus object A can only indirectly invoke object C via some method in object B.…”

Section: Graph Grammar Parsingmentioning

confidence: 99%

“…In this way, the behavior verification problem is cast to the problem of graph parsing. The framework is supported by a visual language environment called VEGGIE [1], an integrated graph grammar induction and parsing system. Fig.1 depicts an overview of the framework, which includes two stages.…”

Section: Introductionmentioning

confidence: 99%

A Grammar-Based Reverse Engineering Framework for Behavior Verification

Zhao

Zhang

2008

2008 11th IEEE High Assurance Systems Engineering Symposium

Self Cite

View full text Add to dashboard Cite

show abstract

“…A substructure is defined as a representation of the recurring subgraphs. An instance is defined as one instance of such substructure in the graph dataset [2].…”

Section: The Grammar Induction Systemmentioning

confidence: 99%