Machine Learning
Network Intrusion Detection: An Analyst's Handbook
Network Intrusion Detection: An Analyst's Handbook
Practical automated detection of stealthy portscans
Journal of Computer Security
Hypothesizing and reasoning about attacks missed by intrusion detection systems
ACM Transactions on Information and System Security (TISSEC)
Probabilistic anomaly detection in distributed computer networks
Science of Computer Programming
Immune system approaches to intrusion detection --- a review
Natural Computing: an international journal
A formal framework for positive and negative detection schemes
IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics
Human interface for cyber security anomaly detection systems
HSI'09 Proceedings of the 2nd conference on Human System Interactions
Hi-index | 0.00 |
Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks. An IDS's responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and SNORT is one popular and actively developing open-source IDS that uses such a set of signatures known as SNORT rules. Our aim is to identify a way in which SNORT could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current SNORT rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard data sets and show that we are able to detect previously undetected variants of various attacks.