User Intention-Based Traffic Dependence Analysis for Anomaly Detection

Simple item page
dc.contributor.authorZhang, Haoen
dc.contributor.authorBanick, Williamen
dc.contributor.authorYao, Danfeng (Daphne)en
dc.contributor.authorRamakrishnan, Narenen
dc.contributor.departmentComputer Scienceen
dc.date.accessioned2013-06-19T14:36:05Zen
dc.date.available2013-06-19T14:36:05Zen
dc.date.issued2012en
dc.description.abstractThis paper describes an approach for enforcing dependencies between network traffic and user activities for anomaly detection. We present a framework and algorithms that analyze user actions and network events on a host according to their dependencies. Discovering these relations is useful in identifying anomalous events on a host that are caused by software flaws or malicious code. To demonstrate the feasibility of user intention-based traffic dependence analysis, we implement a prototype called CR-Miner and perform extensive experimental evaluation of the accuracy, security, and efficiency of our algorithm. The results show that our algorithm can identify user intention-based traffic dependence with high accuracy (average 99:6% for 20 users) and low false alarms. Our prototype can successfully detect several pieces of HTTP-based real-world spyware. Our dependence analysis is fast with a minimal storage requirement. We give a thorough analysis on the security and robustness of the user intention-based traffic dependence approach.en
dc.format.mimetypeapplication/pdfen
dc.identifierhttp://eprints.cs.vt.edu/archive/00001193/en
dc.identifier.sourceurlhttp://eprints.cs.vt.edu/archive/00001193/01/CRminer-techreport.pdfen
dc.identifier.trnumberTR-12-07en
dc.identifier.urihttp://hdl.handle.net/10919/19481en
dc.language.isoenen
dc.publisherDepartment of Computer Science, Virginia Polytechnic Institute & State Universityen
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectParallel computationen
dc.titleUser Intention-Based Traffic Dependence Analysis for Anomaly Detectionen
dc.typeTechnical reporten
dc.type.dcmitypeTexten

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
CRminer-techreport.pdf
Size:
358.01 KB
Format:
Adobe Portable Document Format
Download

Collections

Computer Science Technical Reports
Destination Area: Integrated Security (IS)