Predictive Rule Discovery for Network Intrusion Detection

Abstract. A good number of android applications are available in markets on the Internet. Among them a good number of applications are law quality apps (or malware) and therefore it is difficult for android users to decide whether particular application is malware or benign at installation time. In this paper, we propose a design of system to classify android applications into two classes i.e. malware or benign. We have used hybrid approach by combining application analysis and machine learning technique to classify the applications. Application analysis is performed by both static and live analysis techniques. Genetic algorithm based machine learning technique is used to create rules for creating rule base for the system. The system is tested with applications collected from the various markets on the Internet and two datasets. We have obtained 96.43 % detection rate to classify the applications.

show abstract

“…It generates IF-THEN rules. We have used approach as described by us in Patel and Buddhadev [36]. Some of the rules generated are as below:…”

Section: Rules Generationmentioning

confidence: 99%

Detection and Mitigation of Android Malware Through Hybrid Approach

Patel

Buddadev²

2015

Communications in Computer and Information Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Also, hybrid approaches have been proposed in the literature for detection and mitigation of Android malware. For example, Patel and Buddhadev [15] combine Android applications analysis and machine learning (ML) to classify the applications using static and dynamic analysis techniques. Genetic algorithm based ML technique is used to generate a rules-based model of the system.…”

Section: Related Workmentioning

confidence: 99%

“…The latter function saves the partial trace contained in the parameter p0 into the register v0 at line (13). At lines (15) and (16), two new instances are created, respectively: a new thread and new instance of the class EmbeddedClient. Their instances are initialized, respectively, at lines (17) and (18).…”

Section: Hook Examplementioning

confidence: 99%

“…The natural next step is to automate these parts of the process. For example, in the literature there are several approaches that can be implemented in order to automatically generate more IF-THEN rules [15] or to resort to the MonkeyRunner kit available in Android SDK to simulate the user interactions. Of course, the outcomes of the 8-sample malware presented here are limited to longest time interval used in the study, which was 10 minutes.…”

Section: Limitationsmentioning

confidence: 99%

See 1 more Smart Citation

Detection and Visualization of Android Malware Behavior

Somarriba

Zurutuza

Uribeetxeberria

et al. 2016

Journal of Electrical and Computer Engineering

View full text Add to dashboard Cite

Malware analysts still need to manually inspect malware samples that are considered suspicious by heuristic rules. They dissect software pieces and look for malware evidence in the code. The increasing number of malicious applications targeting Android devices raises the demand for analyzing them to find where the malcode is triggered when user interacts with them. In this paper a framework to monitor and visualize Android applications’ anomalous function calls is described. Our approach includes platform-independent application instrumentation, introducing hooks in order to trace restricted API functions used at runtime of the application. These function calls are collected at a central server where the application behavior filtering and a visualization take place. This can help Android malware analysts in visually inspecting what the application under study does, easily identifying such malicious functions.

show abstract

“…Inexpensive solutions are achieved with an acceptable trade-off between robustness and forbearance for inaccuracy and partial truth [4]. When used in intrusion detection, soft computing techniques can be complemented by rule based expert knowledge described as a set of IF-THEN rules [5]. An IF-THEN rule is composed of a rule body, i.e., antecedent, and a rule head, i.e., consequent.…”

Section: Introductionmentioning

confidence: 99%

A Review of Rule Learning-Based Intrusion Detection Systems and Their Prospects in Smart Grids

2021

View full text Add to dashboard Cite

Intrusion detection systems (IDS) are commonly categorized into misuse based, anomaly based and specification based IDS. Both misuse based IDS and anomaly based IDS are extensively researched in academia and industry. However, as critical infrastructures including smart grids (SG) may often face sophisticated unknown attacks in the near future, misuse based attack detection techniques will mostly miss their targets. Despite the fact that anomaly based IDS can detect novel attacks, they are not often deployed in industry, mainly owing to high false positive rate and lack of interpretability of trained models. With misuse based IDS' inability to detect unknown attacks and requirement for frequently manually crafting and updating signatures and with anomaly based IDS' bad reputation for high false alarm rate, specification based IDS can be regarded as the most suitable detection engine for cyber-physical systems (CPS) including SG. We argue that specification based IDS especially using rule learning could prove to be the most promising IDS for SG. Intrusion detection rules are learned through rule learning techniques and periodically automatically updated to accommodate dynamic system behaviors in SG. Fortunately, rule learning based IDS can not only detect previously unknown attacks but also achieve higher interpretability, due to symbolic representation of learned rules. It can thus be considered more "trustworthy" from human perspective and further assist human in the loop security operation. The present work provides a systematic and deep analysis of rule learning techniques and their suitability for IDS in SG. Besides, it concludes the most important criteria for learning intrusion detection rules and assessing their quality. This work serves not only as a guide to a number of important rule learning techniques but also as the first survey on their applications in IDS, which indicates their potential opportunities in SG security.

show abstract

Predictive Rule Discovery for Network Intrusion Detection

Cited by 6 publications

References 24 publications

Detection and Mitigation of Android Malware Through Hybrid Approach

Detection and Mitigation of Android Malware Through Hybrid Approach

Detection and Visualization of Android Malware Behavior

A Review of Rule Learning-Based Intrusion Detection Systems and Their Prospects in Smart Grids

Contact Info

Product

Resources

About