NDLI: Measuring intrusion detection capability: an information-theoretic approach

Please wait, while we are loading the content...

Emergent properties in ad-hoc networks: a security perspective

Improving secure server performance by re-balancing SSL/TLS handshakes

Privacy-preserving semantic interoperation and access control of heterogeneous databases

Measuring intrusion detection capability: an information-theoretic approach

Self-organised group key management for ad hoc networks

An attack-localizing watermarking scheme for natural language documents

Software integrity protection using timed executable agents

Supporting location-based conditions in access control policies

Fortifying password authentication in integrated healthcare delivery systems

Periodicity, complementarity and complexity of 2-adic FCSR combiner generators

An efficient key establishment scheme for secure aggregating sensor networks

Identity-based registry for secure interdomain routing

Digital invisible ink: revealing true secrets via attacking

A general design towards secure ad-hoc collaboration

Democratic group signatures: on an example of joint ventures

Policy-based encryption schemes from bilinear pairings

Secure information sharing enabled by Trusted Computing and PEI models

Provably secure password-based authentication in TLS

Publicly verifiable ownership protection for relational databases

Time series modeling for IDS alert management

Lightweight, pollution-attack resistant multicast authentication scheme

Tamper proofing and attack identification of corrupted image by using semi-fragile multiple-watermarking algorithm

Application security support in the operating system kernel

A secure system for data access based on anonymous authentication and time-dependent hierarchical keys

Collusion secure convolutional fingerprinting information codes

Cryptanalysis of the "Grain" family of stream ciphers

An efficient broadcast authentication scheme in wireless sensor networks

Dynamic rule-ordering optimization for high-speed firewall filtering

Quadtree based perceptual watermarking scheme

A distributed key assignment protocol for secure multicast based on proxy cryptography

Analysis of traceability attack on Camenisch et al.'s blind signature schemes

A refined look at Bernstein's AES side-channel analysis

TRUST: in cyberspace and beyond

Certified mailing lists

Augmenting storage with an intrusion response primitive to ensure the security of critical data

Image-adaptive watermarking based on perceptually shaping watermark blockwise

Addressing the shortcomings of one-way chains

Digitally signed document sanitizing scheme based on bilinear maps

Continuous fingerprints classification by symmetrical filters

An efficient secure communication between set-top box and smart card in DTV broadcasting

Restricted message signing

Attack graph generation and analysis

Designated group credentials

Design space and analysis of worm defense strategies

Finding the original point set hidden among chaff

Safety analysis of usage control authorization models

Ring signatures without random oracles

Forgery attack on the RPC incremental unforgeable encryption scheme

Security vulnerabilities: from measurements to design

A control flow obfuscation method to discourage malicious tampering of software codes

Can machine learning be secure?

Problems on the MR micropayment schemes

Design and implementation of a reconfigurable hardware for secure embedded systems

Measuring intrusion detection capability: an information-theoretic approach

Content Provider	ACM Digital Library
Author	Gu, Guofei Fogla, Prahlad Dagon, David Lee, Wenke Skorić, Boris
Abstract	A fundamental problem in intrusion detection is what metric(s) can be used to objectively evaluate an intrusion detection system (IDS) in terms of its ability to correctly classify events as normal or intrusive. Traditional metrics (e.g., true positive rate and false positive rate) measure different aspects, but no single metric seems sufficient to measure the capability of intrusion detection systems. The lack of a single unified metric makes it difficult to fine-tune and evaluate an IDS. In this paper, we provide an in-depth analysis of existing metrics. Specifically, we analyze a typical cost-based scheme [6], and demonstrate that this approach is very confusing and ineffective when the cost factor is not carefully selected. In addition, we provide a novel information-theoretic analysis of IDS and propose a new metric that highly complements cost-based analysis. When examining the intrusion detection process from an information-theoretic point of view, intuitively, we should have less uncertainty about the input (event data) given the IDS output (alarm data). Thus, our new metric, CI D (Intrusion Detection Capability), is defined as the ratio of the mutual information between the IDS input and output to the entropy of the input. CI D has the desired property that: (1) It takes into account all the important aspects of detection capability naturally, i.e., true positive rate, false positive rate, positive predictive value, negative predictive value, and base rate; (2) it objectively provides an intrinsic measure of intrusion detection capability; and (3) it is sensitive to IDS operation parameters such as true positive rate and false positive rate, which can demonstrate the effect of the subtle changes of intrusion detection systems. We propose CI D as an appropriate performance measure to maximize when fine-tuning an IDS. The obtained operation point is the best that can be achieved by the IDS in terms of its intrinsic ability to classify input data. We use numerical examples as well as experiments of actual IDSs on various data sets to show that by using CI D, we can choose the best (optimal) operating point for an IDS and objectively compare different IDSs.
Starting Page	90
Ending Page	101
Page Count	12
File Format	PDF
ISBN	1595932720
DOI	10.1145/1128817.1128834
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2006-03-21
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Intrusion detection Performance measurement Information-theoretic
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in