论文信息 - Efficient deterministic method for detecting new U2R attacks

Efficient deterministic method for detecting new U2R attacks

The purpose of this study is to describe an efficient deterministic intrusion detection approach that detects both old and new attacks. We especially focused on detecting the user to root (U2R) attacks of the 1999 DARPA evaluation dataset. The main idea of our approach is to test if an unknown behavior is close enough to a known behavior (attack or normal) such as we can conclude that it belongs to its class. To achieve that, we formulate the problem of intrusion detection as a linear programming system (LPS). The objective function of this LPS leads to minimize the distance between an unknown behavior and one of the known behaviors, by respect of some constraints. The solution of such a problem is a set of bivalent variables x"i"j. If (x"i"j=1) then we can conclude that the unknown behavior i belong to the class of behaviors j. Our experiments demonstrated the efficiency of our approach.

Rachid Beghdad | Rachid Beghdad

[1] Salvatore J. Stolfo,et al. A framework for constructing features and models for intrusion detection systems , 2000, TSEC.

[2] Robert K. Cunningham,et al. Detecting Low-Profile Probes and Novel Denial-of-Service Attacks , 2001 .

[3] LeeWenke,et al. A framework for constructing features and models for intrusion detection systems , 2000 .

[4] Rachid Beghdad. Modelling and solving the intrusion detection problem in computer networks , 2004, Comput. Secur..

[5] N. Ye,et al. A Scalable Clustering Technique for Intrusion Signature Recognition , 2001 .

[6] Ronald L. Rivest,et al. Introduction to Algorithms, Second Edition , 2001 .

[7] Philip K. Chan,et al. Detecting novel attacks by identifying anomalous network packet headers , 2001 .

[8] Ronald L. Rivest,et al. Introduction to Algorithms , 1990 .

[9] Clifford Stein,et al. Introduction to Algorithms, 2nd edition. , 2001 .