NDLI: Prioritizing intrusion analysis using Dempster-Shafer theory

Please wait, while we are loading the content...

Judging a site by its content: learning the textual, structural, and visual features of malicious web pages

A comparative assessment of malware classification using binary texture analysis and dynamic analysis

Adversarial machine learning

Prioritizing intrusion analysis using Dempster-Shafer theory

Understanding the risk factors of learning in adversarial environments

Exploitation as an inference problem

Topic modeling of freelance job postings to monitor web service abuse

ZDVUE: prioritization of javascript attacks to discover new vulnerabilities

An algorithm to find optimal attack paths in nondeterministic scenarios

Artificial intelligence and the future of cybersecurity

Categorizing CAPTCHA

Evolutionary construction of de bruijn sequences

Machine learning in computer forensics (and the lessons learned from machine learning in computer security)

Accessibility of CAPTCHA methods

A robust one-class bayesian approach for masquerade detection

On deployable adversarial classification models

Prioritizing intrusion analysis using Dempster-Shafer theory

Content Provider	ACM Digital Library
Author	Zomlot, Loai Ou, Xinming Rajagopalan, S. Raj Sundaramurthy, Sathya Chandran Luo, Kui
Abstract	Intrusion analysis and incident management remains a difficult problem in practical network security defense. The root cause of this problem is the large rate of false positives in the sensors used by Intrusion Detection System (IDS) systems, reducing the value of the alerts to an administrator. Standard Bayesian theory has not been effective in this regard because of the lack of good prior knowledge. This paper presents an approach to handling such uncertainty without the need for prior information, through the Dempster-Shafer (DS) theory. We address a number of practical but fundamental issues in applying DS to intrusion analysis, including how to model sensors' trustworthiness, where to obtain such parameters, and how to address the lack of independence among alerts. We present an efficient algorithm for carrying out DS belief calculation on an IDS alert correlation graph, so that one can compute a belief score for a given hypothesis, e.g. a specific machine is compromised. The belief strength can be used to sort incident-related hypotheses and prioritize further analysis by a human analyst of the hypotheses and the associated evidence. We have implemented our approach for the open-source IDS system Snort and evaluated its effectiveness on a number of data sets as well as a production network. The resulting belief scores were verified through both anecdotal experience on the production system as well as by comparing the belief rankings of hypotheses with the ground truths provided by the data sets we used in evaluation, showing thereby that belief scores can be effective in mitigating the high false positive rate problem in intrusion analysis.
Starting Page	59
Ending Page	70
Page Count	12
File Format	PDF
ISBN	9781450310031
DOI	10.1145/2046684.2046694
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2011-10-21
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Reason about uncertainty Intrusion detection and analysis Dempster-shafer theory Enterprise network security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in