The characterization of processes behavior is usually considered when performing intrusion detection. Several works characterize specific aspects of systems and attempt to detect novelties in that context, associating observed anomalies to attack events. Such approach is limited or even useless when the observed context is unstructured, i.e. when the monitor generates text-based log files or a ...

This paper presents some proposals and contributions in network-based intrusion-related technologies. Two key points are discussed in this line: anomaly-based intrusion detection, and active response mechanisms. The first issue is mainly focused on the consideration of a stochastic approach to model the normal behavior of the network system to be monitored and protected. This anomaly-based dete...

Earthquakes, hurricanes, terrorist attacks, and other such events can cause tremendous harm to people and infrastructure, often leaving those outside the areas impacted with little or no information on the state of their friends and relatives who may have been affected. Our goal is to automatically process images of patients taken as part of the intake process at emergencymedical care centers t...

Résumé. Intrusion detection is an important topic dealing with security of information systems. Most successful Intrusion Detection Systems (IDS) rely on signature detection and need to update their signature as fast as new attacks are emerging. On the other hand, anomaly detection may be utilized for this purpose, but it suffers from a high number of false alarms. Actually, any behaviour which...

The wide spread of worms poses serious challenges to today’s Internet. Various IDSes (Intrusion Detection Systems) have been proposed to identify or prevent such spread. These IDSes can be largely classified as signature-based or anomaly-based ones depending on what type of knowledge the system knows. Signature-based IDSes are unable to detect the outbreak of new and unidentified worms when the...

In 1987 Dorothy Denning wrote in her seminal paper “An Intrusion-Detection Model” the following words: “exploitation of a system’s vulnerabilities involves abnormal use of the system; therefore, security violations could be detected from abnormal patterns of usage.” With these words, Denning kicked off 20 years of research, development, and publications in anomaly-based intrusion detection, whe...

We present Andromaly a behavioral-based detection framework for Android-powered mobile devices. The proposed framework realizes a Host-based Intrusion Detection System (HIDS) that continuously monitors various features and events obtained from the mobile device, and then applies Machine Learning methods to classify the collected data as normal (benign) or abnormal (malicious). Since no maliciou...

Grundsätzlich ist es erwünscht, dass die IT-Sicherheit eines Unternehmens so hoch ist, dass jeder Missbrauch und jedes Eindringen in die ITInfrastrukturen im Vorfeld verhindert werden kann. Da es aber keine Möglichkeit gibt IT-Infrastrukturen so abzusichern, dass ein Einbruch und Missbrauch völlig ausgeschlossen werden können, wird in sicherheitskritischen IT-Infrastrukturen die Möglichkeit ben...

Motivation: Faces form a class of visually similar objects that simplifies the generally difficult task of object detection. However, the problem of pose invariance is still unsolved. There are three basic ideas behind partor component-based detection of objects. First, some objects classes can be described well by a few characteristic object parts and their geometrical relation. Second, the pa...