Intrusion Detection. Jeffrey J.P. Tsai. Imperial College Press. A Machine Learning Approach. Zhenwei Yu. University of Illinois, Chicago, USA

Transcription

1 SERIES IN ELECTRICAL AND COMPUTER ENGINEERING Intrusion Detection A Machine Learning Approach Zhenwei Yu University of Illinois, Chicago, USA Jeffrey J.P. Tsai Asia University, University of Illinois, Taiwan Chicago, USA Imperial College Press

2 Contents Preface vii 1. Introduction Background 1.2 Existing Problems Alarm management Performance maintenance Attacks and Countermeasures in Computer Security General Security Objectives Accountability Assurance Authentication Authorization Availability Confidentiality Integrity Non-repudiation Types of Attacks Attacks against availability Attacks against confidentiality Attacks against integrity Attacks against miscellaneous security objectives Countermeasures of Attacks Authentication Access control Audit and intrusion detection 20 ix

3 x Intrusion Detection: A Machine Learning Approach Extrusion detection Cryptography Firewall Anti-virus software Machine Learning Methods Background Concept Learning Decision Tree Neural Networks Bayesian Learning Genetic Algorithms and Genetic Programming Instance-Based Learning Inductive Logic Programming Analytical Learning Inductive and Analytical Learning Reinforcement Learning Ensemble Learning Multiple Instance Learning Unsupervised Learning Semi-Supervised Learning Support Vector Machines Intrusion Detection System Background Security defense in depth A brief history of intrusion detection Classification of intrusion detection system Standardization efforts General model of intrusion detection system Available Audit Data System features User activities Network activities Preprocess Methods Detection Methods Statistical analysis Expert system 51

4 Contents x\ Model-based system State transition-based analysis Neural network-based system Data mining-based system Architecture for Network Intrusion Detection System 56 Part A: Intrusion Detection for Wired Network 5. Techniques for Intrusion Detection Available Alarm Management Solutions Alarm correlation Alarm filter Event classification process Available Performance Maintenance Solutions Adaptive learning Incremental mining Adaptive Automatically Tuning Intrusion Detection System Architecture SOM-Based Labeling Tool Training algorithm Pre-cluster by symbolic features Cluster by SOM Label data in clusters Hybrid Detection Model Binary SLIPPER rule learning system Binary classifiers Final arbiter Detection model tuning Fuzzy prediction filter Fuzzy tuning controller System Prototype and Performance Evaluation Implementation of Prototype Fuzzy controller Binary prediction and model tuning thread Final arbiter and prediction filter thread 102

5 xjj Intrusion Detection: A Machine Learning Approach User simulator thread Interface for fuzzy knowledge base Experimental Data set and Related Systems KDDCup'99 intrusion detection data set Performance evaluation method Related IDSs on KDDCup'99 ID data set Performance Evaluation SOM-based labeling tool performance Build hybrid detection model The MC-SLIPPER system and test performance The ATIDS system and test performance The ADAT IDS system and test performance Part B: Intrusion Detection for Wireless Sensor Network 8. Attacks against Wireless Sensor Network Wireless Sensor Network Challenges on Intrusion Detection in WSNs Attacks against WSNs Intrusion Detection System for Wireless Sensor Network Architecture of IDS for WSN Audit Data in WSN Local features for LIDC in WSN Packet features for PIDC in WSN Detection Model and Optimization Model Tuning Conclusion and Future Research 157 Cited Literature 159 Index 169