Audit sequences have been used effectively to study process behaviors and build host-based intrusion detection models. Most sequencebased techniques make use of a pre-defined window size for scanning the sequences to model process behavior. In this paper, we propose two methods for extracting variable length patterns from audit sequences that avoid the necessity of such a pre-determined paramet...

A hybrid approach for intrusion detection in computer networks is presented in this paper. The proposed approach combines an evolutionary-based fuzzy system with an Ant Colony Optimization procedure to generate high-quality fuzzy-classification rules. We applied our hybrid learning approach to network security and validated it using the DARPA KDD-Cup99 benchmark data set. The results indicate t...

18. NUMBER

high processing loads, need for complicated and frequent updating, and high false alarm are some of the challenges in designing anomaly detection and misuse detection systems. we propose a new network-based intrusion detection system (ids) that resolves such shortcomings. our scheme fuses anomaly detection and misuse detection systems, which has not been utilized so far in existing systems. in ...

Recently, Advanced Persistent Threat (APT) has emerged as sophisticated and tailor-made attacks. APTs pose threats mainly targeting institutions such military, defense security infrastructure, high profile companies governments etc. Particularly a counter measure for APT attacks done by hactivists cyber warriors terrorists over government e-government applications intrusion detection mechanisms...

In 1987 Dorothy Denning wrote in her seminal paper “An Intrusion-Detection Model” the following words: “exploitation of a system’s vulnerabilities involves abnormal use of the system; therefore, security violations could be detected from abnormal patterns of usage.” With these words, Denning kicked off 20 years of research, development, and publications in anomaly-based intrusion detection, whe...

We present Andromaly a behavioral-based detection framework for Android-powered mobile devices. The proposed framework realizes a Host-based Intrusion Detection System (HIDS) that continuously monitors various features and events obtained from the mobile device, and then applies Machine Learning methods to classify the collected data as normal (benign) or abnormal (malicious). Since no maliciou...

Grundsätzlich ist es erwünscht, dass die IT-Sicherheit eines Unternehmens so hoch ist, dass jeder Missbrauch und jedes Eindringen in die ITInfrastrukturen im Vorfeld verhindert werden kann. Da es aber keine Möglichkeit gibt IT-Infrastrukturen so abzusichern, dass ein Einbruch und Missbrauch völlig ausgeschlossen werden können, wird in sicherheitskritischen IT-Infrastrukturen die Möglichkeit ben...