This paper presents a series of studies on probabilistic properties of activity data in an information system for detecting intrusions into the information system. Various probabilistic techniques of intrusion detection, including decision tree, Hotelling's T/sup 2/ test, chi-square multivariate test, and Markov chain are applied to the same training set and the same testing set of computer audit data for investigating the frequency property and the ordering property of computer audit data. The results of these studies provide answers to several questions concerning which properties are critical to intrusion detection. First, our studies show that the frequency property of multiple audit event types in a sequence of events is necessary for intrusion detection. A single audit event at a given time is not sufficient for intrusion detection. Second, the ordering property of multiple audit events provides additional advantage to the frequency property for intrusion detection. However, unless the scalability problem of complex data models taking into account the ordering property of activity data is solved, intrusion detection techniques based on the frequency property provide a viable solution that produces good intrusion detection performance with low computational overhead.

Probabilistic techniques for intrusion detection based on computer audit data

Cyber-attack detection is used to identify cyber-attacks while they are acting on a computer and network system to compromise the security (e.g., availability, integrity, and confidentiality) of the system. This paper presents a cyber-attack detection technique through anomaly-detection, and discusses the robustness of the modeling technique employed. In this technique, a Markov-chain model represents a profile of computer-event transitions in a normal/usual operating condition of a computer and network system (a norm profile). The Markov-chain model of the norm profile is generated from historic data of the system's normal activities. The observed activities of the system are analyzed to infer the probability that the Markov-chain model of the norm profile supports the observed activities. The lower probability the observed activities receive from the Markov-chain model of the norm profile, the more likely the observed activities are anomalies resulting from cyber-attacks, and vice versa. This paper presents the learning and inference algorithms of this anomaly-detection technique based on the Markov-chain model of a norm profile, and examines its performance using the audit data of UNIX-based host machines with the Solaris operating system. The robustness of the Markov-chain model for cyber-attack detection is presented through discussions & applications. To apply the Markov-chain technique and other stochastic process techniques to model the sequential ordering of events, the quality of activity-data plays an important role in the performance of intrusion detection. The Markov-chain technique is not robust to noise in the data (the mixture level of normal activities and intrusive activities). The Markov-chain technique produces desirable performance only at a low noise level. This study also shows that the performance of the Markov-chain techniques is not always robust to the window size: as the window size increases, the amount of noise in the window also generally increases. Overall, this study provides some support for the idea that the Markov-chain technique might not be as robust as the other intrusion-detection methods such as the chi-square distance test technique , although it can produce better performance than the chi-square distance test technique when the noise level of the data is low, such as the Mill & Pascal data in this study.

Robustness of the Markov-chain model for cyber-attack detection

Altay Aksulu Schulich School of Business, York University aaksulu@schulich.yorku.ca

/pdf/a-comprehensive-review-and-synthesis-of-open-source-research-5fkclzdy77.pdf

A Comprehensive Review and Synthesis of Open Source Research

In defense of the realm: understanding the threats to information security

This compilation was prepared for the Dudley Knox Library, Naval Postgraduate School, Monterey, CA.

Information Warfare and Information Operations (IW/IO) : A Bibliography

One of the most powerful movements in the information technology community today is the widespread adoption of free and open-source software (FOSS) What was once an idealistic fringe movement conceived and formalized by MacArthur award laureate Richard Stallman has now become one of the most powerful influences in the world of information technology As FOSS systems grow in popularity, questions of the reliability and security of these systems emerge, especially in comparison with proprietary systems This paper surveys the arguments presented by proponents of each type of software in published reports and discusses the deployment and reliability figures for both FOSS and proprietary systems as well

Open-source versus proprietary software: is one more reliable and secure than the other?

For years, “hackers” have broken into computer systems, and now an entire industry is dedicated to computer network security. Both hackers and computer security professionals have developed software tools for either breaking into systems or identifying potential security problems within computer networks. This software can be found on compromised systems as well as within the toolkits of legitimate “tiger” teams that operate with the consent of the network owners. This paper describes some of the current techniques and tools employed by the hacker underground in breaching the security of networked computers, focusing primarily on UNIX®-based hosts connected to TCP/IP networks.

A. Boulanger

Papers

Open-source versus proprietary software: is one more reliable and secure than the other?

Catapults and grappling hooks: the tools and techniques of information warfare