NDLI: Intrusion detection in enterprise systems by combining and clustering diverse monitor data

Please wait, while we are loading the content...

Abstract runtime structure for reasoning about security: poster

Efficient solving of string constraints for security analysis

Intrusion detection in enterprise systems by combining and clustering diverse monitor data

Security is about control: insights from cybernetics

Characterizing cybersecurity jobs: applying the cyber aptitude and talent assessment framework

A framework for generation, replay, and analysis of real-world attack variants

Establishing a baseline for measuring advancement in the science of security: an analysis of the 2015 IEEE security & privacy proceedings

Systematic analysis of qualitative data in security

Controller synthesis for linear dynamical systems with adversaries

Expressing and reasoning about conflicting norms in cybersecurity: poster

Toward a normative approach for forensicability

Modules in wyvern: advanced control over security and privacy

A model-based approach to anomaly detection in software architectures

Optimal thresholds for intrusion detection systems

Safety-critical cyber-physical attacks: analysis, detection, and mitigation

Decentralization and security in dynamic traffic light control

Visualizing the variational callgraph of the Linux kernel: an approach for reasoning about dependencies [poster]

Differences in trust between human and automated decision aids

Software and attack centric integrated threat modeling for quantitative risk assessment

Security practices in DevOps

Operation-level traffic analyzer framework for smart grid

Raindroid: a system for run-time mitigation of Android intent vulnerabilities [poster]

Modeling, analyzing, and consistency checking privacy requirements using eddy

Risk-based attack surface approximation: poster

Text analytics for security: tutorial

The persuasive phish: examining the social psychological principles hidden in phishing emails

Intrusion detection in enterprise systems by combining and clustering diverse monitor data

Content Provider	ACM Digital Library
Author	Sanders, William H. Thakore, Uttam Bohara, Atul
Abstract	Intrusion detection using multiple security devices has received much attention recently. The large volume of information generated by these tools, however, increases the burden on both computing resources and security administrators. Moreover, attack detection does not improve as expected if these tools work without any coordination. In this work, we propose a simple method to join information generated by security monitors with diverse data formats. We present a novel intrusion detection technique that uses unsupervised clustering algorithms to identify malicious behavior within large volumes of diverse security monitor data. First, we extract a set of features from network-level and host-level security logs that aid in detecting malicious host behavior and flooding-based network attacks in an enterprise network system. We then apply clustering algorithms to the separate and joined logs and use statistical tools to identify anomalous usage behaviors captured by the logs. We evaluate our approach on an enterprise network data set, which contains network and host activity logs. Our approach correctly identifies and prioritizes anomalous behaviors in the logs by their likelihood of maliciousness. By combining network and host logs, we are able to detect malicious behavior that cannot be detected by either log alone.
Starting Page	7
Ending Page	16
Page Count	10
File Format	PDF
ISBN	9781450342773
DOI	10.1145/2898375.2898400
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-04-19
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Intrusion detection Machine learning Clustering Security Anomaly detection Monitoring
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Applying kernel methods to anomaly based intrusion detection systems

Anomaly-Based Intrusion Detection using Fuzzy Rough Clustering

Outside the Closed World: On Using Machine Learning for Network Intrusion Detection

Data clustering-based anomaly detection in industrial control systems

Novel intrusion prevention and detection methods

Network anomaly detection: a machine learning perspective

Active learning for network intrusion detection

A New Approach to Network Anomaly Attack Detection

An Outlier Mining-Based Method for Anomaly Detection

Intrusion detection in enterprise systems by combining and clustering diverse monitor data

Similar Documents

Applying kernel methods to anomaly based intrusion detection systems

Anomaly-Based Intrusion Detection using Fuzzy Rough Clustering

Outside the Closed World: On Using Machine Learning for Network Intrusion Detection

Data clustering-based anomaly detection in industrial control systems

Novel intrusion prevention and detection methods

Network anomaly detection: a machine learning perspective

Active learning for network intrusion detection

A New Approach to Network Anomaly Attack Detection

An Outlier Mining-Based Method for Anomaly Detection

Intrusion detection in enterprise systems by combining and clustering diverse monitor data