Preemptive intrusion detection

Cao, Phuong; Chung, Keywhan; Kalbarczyk, Zbigniew; Iyer, Ravishankar K.; Slagell, Adam

doi:10.1145/2600176.2600197

Cited by 4 publications

(4 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To address the limitations of previous efforts, we use Factor Graphs, a type of probabilistic graphical model that unifies BNs and MRFs [8,4]. Unlike signature and anomaly techniques, Factor Graphs do not rely on a single rule or an anomaly measure.…”

Section: Related Workmentioning

confidence: 99%

Preemptive intrusion detection

Cao

Badger

Kalbarczyk

et al. 2015

Proceedings of the 2015 Symposium and Bootcamp on the Science of Security

Self Cite

View full text Add to dashboard Cite

This paper presents a Factor Graph based framework called AttackTagger for highly accurate and preemptive detection of attacks, i.e., before the system misuse. We use security logs on real incidents that occurred over a six-year period at the National Center for Supercomputing Applications (NCSA) to evaluate AttackTagger. Our data consist of security incidents that led to compromise of the target system, i.e., the attacks in the incidents were only identified after the fact by security analysts. AttackTagger detected 74 percent of attacks, and the majority them were detected before the system misuse. Finally, AttackTagger uncovered six hidden attacks that were not detected by intrusion detection systems during the incidents or by security analysts in post-incident forensic analysis.

show abstract

Section: Related Workmentioning

confidence: 99%

Preemptive intrusion detection

Cao

Badger

Kalbarczyk

et al. 2015

Proceedings of the 2015 Symposium and Bootcamp on the Science of Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…However, the only way to control the distribution Pr : Θ → [0, 1] of the trust profiles of a population of systems to which S belongs is to model this population in the experimental environment of a laboratory, where I could control that the sample is distributed according to Pr : Θ → [0, 1]. Sampling the behaviors of the system S in this controlled environment would then allow me to calculate Pr(θ|x) according to (7) for all profiles θ ∈ Θ, and to select the most likely profile θ = 0 ∈ Θ as my current trust hypothesis about S. But even this experimental environment, where I can impose the prior probability Pr : Θ → [0, 1] by controlling the sample, does not give me the prior probabilities Pr θ : B → [0, 1], which express the trust hypotheses to be tested. Where do they come from?…”

Section: Experimental Testing Of Trustmentioning

confidence: 99%

“…It is much easier to characterize each of the abnormal behaviors, which we learn from the anomalies experienced in the past. That is why the statistical intrusion detection systems [10,24,7] and forensics mostly work with the statistical profiles of intruders and criminals, and test these profiles as the null hypotheses.…”

Section: The Scientific Presumption Of Innocencementioning

confidence: 99%

See 1 more Smart Citation

Towards a science of trust

Pavlović

2015

Proceedings of the 2015 Symposium and Bootcamp on the Science of Security

View full text Add to dashboard Cite

It is unclear how to think about trust or to model its ebb and flow. Is there some sort of Second Law of Thermodynamics of trust, where trust starts high and is dissipated over time? Or is it the contrary, that trust starts low and can grow through a series of good experiences?Is it more complex, and how can the waxing and waning be thought about? JASON Report on Science of Cyber-Security [17] AbstractThe diverse views of science of security have opened up several alleys towards applying the methods of science to security. We pursue a different kind of connection between science and security. This paper explores the idea that security is not just a suitable subject for science, but that the process of security is also similar to the process of science. This similarity arises from the fact that both science and security depend on the methods of inductive inference. Because of this dependency, a scientific theory can never be definitely proved, but can only be disproved by new evidence, and improved into a better theory. Because of the same dependency, every security claim and method has a lifetime, and always eventually needs to be improved.In this general framework of security-as-science, we explore the ways to apply the methods of scientific induction in the process of trust. The process of trust building and updating is viewed as hypothesis testing. We propose to formulate the trust hypotheses by the methods of algorithmic learning, and to build more robust trust testing and vetting methodologies on the solid foundations of statistical inference.

show abstract

Survey of Attack Projection, Prediction, and Forecasting in Cyber Security

Husák

Komárková

Bou‐Harb

et al. 2019

IEEE Commun. Surv. Tutorials

225

110

View full text Add to dashboard Cite

This paper provides a survey of prediction, and forecasting methods used in cyber security. Four main tasks are discussed first, attack projection and intention recognition, in which there is a need to predict the next move or the intentions of the attacker, intrusion prediction, in which there is a need to predict upcoming cyber attacks, and network security situation forecasting, in which we project cybersecurity situation in the whole network. Methods and approaches for addressing these tasks often share the theoretical background and are often complementary. In this survey, both methods based on discrete models, such as attack graphs, Bayesian networks, and Markov models, and continuous models, such as time series and grey models, are surveyed, compared, and contrasted. We further discuss machine learning and data mining approaches, that have gained a lot of attention recently and appears promising for such a constantly changing environment, which is cyber security. The survey also focuses on the practical usability of the methods and problems related to their evaluation.

show abstract

Preemptive intrusion detection

Cited by 4 publications

References 1 publication

Preemptive intrusion detection

Preemptive intrusion detection

Towards a science of trust

Survey of Attack Projection, Prediction, and Forecasting in Cyber Security

Contact Info

Product

Resources

About