Zhang, HaoBanick, WilliamYao, Danfeng (Daphne)Ramakrishnan, Naren2013-06-192013-06-192012http://hdl.handle.net/10919/19481This paper describes an approach for enforcing dependencies between network traffic and user activities for anomaly detection. We present a framework and algorithms that analyze user actions and network events on a host according to their dependencies. Discovering these relations is useful in identifying anomalous events on a host that are caused by software flaws or malicious code. To demonstrate the feasibility of user intention-based traffic dependence analysis, we implement a prototype called CR-Miner and perform extensive experimental evaluation of the accuracy, security, and efficiency of our algorithm. The results show that our algorithm can identify user intention-based traffic dependence with high accuracy (average 99:6% for 20 users) and low false alarms. Our prototype can successfully detect several pieces of HTTP-based real-world spyware. Our dependence analysis is fast with a minimal storage requirement. We give a thorough analysis on the security and robustness of the user intention-based traffic dependence approach.application/pdfenIn CopyrightParallel computationTechnical reportTR-12-07http://eprints.cs.vt.edu/archive/00001193/01/CRminer-techreport.pdf