DTB-IDS: an intrusion detection system based on decision tree using behavior analysis for preventing APT attacks

Moon, Daesung; Im, Hyungjin; Kim, Ikkyun; Park, Jong Hyuk

doi:10.1007/s11227-015-1604-8

Cited by 128 publications

(58 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…is said to belong to one side of the partition F with degree µ F (x) and to the other side with degree (1 − µ F (x)). Since both fuzzy rules [33] and decision tree [43], [44] yield good performance in malware analysis, we hybridize the idea behind these two methods by allowing fuzzy partitions of both types: (i) less than partition x < c, which is the fuzzy version of the ordinary partition for a continuous attribute:…”

Section: A Feature Selectionmentioning

confidence: 99%

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Wang

Liew

et al. 2021

IEEE Trans. Fuzzy Syst.

View full text Add to dashboard Cite

Classification of malicious software, especially in a very large dataset, is a challenging task for machine intelligence. Malware can have highly diversified features, each of which has highly heterogeneous distributions. These factors increase the difficulties for traditional data analytic approaches to deal with them. Although deep learning-based methods have reported good classification performance, the deep models usually lack interpretability and are fragile under adversarial attacks. To solve these problems, fuzzy systems have become a competitive candidate in malware analysis. In this paper, a new fuzzy-based approach is proposed for malware classification. We focused on portable executable files in the Windows platform and analyzed the distributions of static features and content-oriented features. Fuzzification was used to reduce the ubiquitous impact of noise and outliers in a very large dataset. Finally, a novel boosted classifier consisted of fuzzy decision trees and support vector machine is proposed to perform the malware classification. By using fuzzy decision trees, the inner structure of the classifier can be readily interpreted as discriminative rules, while the novel boosting strategy provides state-of-the-art classification performance. Extensive experimental results showed that our method significantly outperformed several state-of-the-art classifiers.

show abstract

Section: A Feature Selectionmentioning

confidence: 99%

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Wang

Liew

et al. 2021

IEEE Trans. Fuzzy Syst.

View full text Add to dashboard Cite

show abstract

“…In [49], the authors applied a decision tree to build IDS to detect APT attacks. It can detect intrusion from the beginning and quickly react to APT to minimize damage.…”

Section: Countering An Advanced Persistent Threatmentioning

confidence: 99%

Artificial Intelligence in the Cyber Domain: Offense and Defense

2020

View full text Add to dashboard Cite

Artificial intelligence techniques have grown rapidly in recent years, and their applications in practice can be seen in many fields, ranging from facial recognition to image analysis. In the cybersecurity domain, AI-based techniques can provide better cyber defense tools and help adversaries improve methods of attack. However, malicious actors are aware of the new prospects too and will probably attempt to use them for nefarious purposes. This survey paper aims at providing an overview of how artificial intelligence can be used in the context of cybersecurity in both offense and defense.

show abstract

“…While this may not always correspond to an attack, alertbased responses address inherent problems in SCADA operations, which are otherwise not possible to capture using traditional IT-based IDS. Based on the requirements of the strict availability, the IDS can respond immediately to unusual situations [56, 63, 69, 91-93, 95, 132, 133, 135, 138, 141], or provide a delayed notification summarizing similar alarms [52,74,79,88,100,114,122,123]. Information-Centric: If we examine the information used for the detection, then IDS systems can be further categorized into Host-based Intrusion Detection (HID) and Networkbased Intrusion Detection (NID).…”

Section: Taxonomy Of Scada-based Idssmentioning

confidence: 99%

A Taxonomy of Supervised Learning for IDSs in SCADA Environments

Suaboot

Fahad²,

Tari

et al. 2020

ACM Comput. Surv.

View full text Add to dashboard Cite

Supervisory Control and Data Acquisition (SCADA) systems play an important role in monitoring industrial processes such as electric power distribution, transport systems, water distribution, and wastewater collection systems. Such systems require a particular attention with regards to security aspects, as they deal with critical infrastructures that are crucial to organizations and countries. Protecting SCADA systems from intrusion is a very challenging task because they do not only inherit traditional IT security threats but they also include additional vulnerabilities related to field components (e.g., cyber-physical attacks). Many of the existing intrusion detection techniques rely on supervised learning that consists of algorithms that are first trained with reference inputs to learn specific information, and then tested on unseen inputs for classification purposes. This article surveys supervised learning from a specific security angle, namely SCADA-based intrusion detection. Based on a systematic review process, existing literature is categorized and evaluated according to SCADA-specific requirements. Additionally, this survey reports on well-known SCADA datasets and testbeds used with machine learning methods. Finally, we present key challenges and our recommendations for using specific supervised methods for SCADA systems.

show abstract

DTB-IDS: an intrusion detection system based on decision tree using behavior analysis for preventing APT attacks

Cited by 128 publications

References 14 publications

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Artificial Intelligence in the Cyber Domain: Offense and Defense

A Taxonomy of Supervised Learning for IDSs in SCADA Environments

Contact Info

Product

Resources

About