We present a host-based intrusion detection system for Microsoft Windows. The core of the system is an algorithm that detects attacks on a host machine by looking for anomalous accesses to the Windows Registry. The key idea is to first train a model of normal registry behavior for a host and to use this model to detect abnormal registry accesses at run-time. The system trains a normal model usi...

Web site defacement, the process of introducing unauthorized modifications to a web site, is a very common form of attack. Detecting such events automatically is very difficult because web pages are highly dynamic and their degree of dynamism, as well as their typical content and appearance, may vary widely across different pages. Anomaly based detection can be a feasible and effective solution...

We present Poseidon, a new anomaly based intrusion detection system. Poseidon is payload-based, and presents a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system [22]. Our benchmarks on the 1999 DARPA data set [15] show a higher detection rate and lower number of false positives than PAYL and PHAD.

This paper presents a distributed hierarchical multiagent architecture for detecting SQL injection attacks against databases. It uses a novel strategy, which is supported by a Case-Based Reasoning mechanism, which provides to the classifier agents with a great capacity of learning and adaptation to face this type of attack. The architecture combines strategies of intrusion detection systems suc...

Intrusion detection system (IDS) has played a central role as an appliance tooliance toely defend our crucial computer systems or networks against attackers on the Internet. The most widely deployed and commercially available methods for intrusion detection employ signaturebased detection. However, they cannot detect unknown intrusions intrinsically which are not matched to the signatures, and ...

Premature combustion that affects outputs, thermal efficiencies and lifetimes of internal combustion engine is called “knock effect”. However knock signal detection based on acoustic sensor is a challenging task due to existing of noise in the same frequency spectrum. Experimental results revealed that vibration signals, generated from knock, has certain frequencies related to vibration resonan...

automatic road extraction from aerial images can be very helpful in traffic control and vehicle guidance systems. most of the road detection approaches are based on image segmentation algorithms. color-based segmentation is very sensitive to light changes and consequently the change of weather condition affects the recognition rate of road detection systems. in order to reduce the light change ...

session initiation protocol (sip) is the main signaling protocol of next generation networks (ngn). sip based applications are usually deployed over the internet, for which their text-based nature and internal stateful operation make them vulnerable to different types of attacks. the real‑time functionality of sip based applications make their related security systems more complex. on the other...

Fraud detection is one of the ways to cope with damages associated with fraudulent activities that have become common due to the rapid development of the Internet and electronic business. There is a need to propose methods to detect fraud accurately and fast. To achieve to accuracy, fraud detection methods need to consider both kind of features, features based on user level and features based o...