Machine Learning is the study of methods for programming computers to learn. Computers are applied to a wide range of tasks, and for most of these it is relatively easy for programmers to design and implement the necessary software. However, there are many tasks for which this is difficult or impossible. These can be divided into four general categories. First, there are problems for which there exist no human experts. For example, in modern automated manufacturing facilities, there is a need to predict machine failures before they occur by analyzing sensor readings. Because the machines are new, there are no human experts who can be interviewed by a programmer to provide the knowledge necessary to build a computer system. A machine learning system can study recorded data and subsequent machine failures and learn prediction rules. Second, there are problems where human experts exist, but where they are unable to explain their expertise. This is the case in many perceptual tasks, such as speech recognition, hand-writing recognition, and natural language understanding. Virtually all humans exhibit expert-level abilities on these tasks, but none of them can describe the detailed steps that they follow as they perform them. Fortunately, humans can provide machines with examples of the inputs and correct outputs for these tasks, so machine learning algorithms can learn to map the inputs to the outputs. Third, there are problems where phenomena are changing rapidly. In finance, for example, people would like to predict the future behavior of the stock market, of consumer purchases, or of exchange rates. These behaviors change frequently, so that even if a programmer could construct a good predictive computer program, it would need to be rewritten frequently. A learning program can relieve the programmer of this burden by constantly modifying and tuning a set of learned prediction rules. Fourth, there are applications that need to be customized for each computer user separately. Consider, for example, a program to filter unwanted electronic mail messages. Different users will need different filters. It is unreasonable to expect each user to program his or her own rules, and it is infeasible to provide every user with a software engineer to keep the rules up-to-date. A machine learning system can learn which mail messages the user rejects and maintain the filtering rules automatically. Machine learning addresses many of the same research questions as the fields of statistics, data mining, and psychology, but with differences of emphasis. Statistics focuses on understanding the phenomena that have generated the data, often with the goal of testing different hypotheses about those phenomena. Data mining seeks to find patterns in the data that are understandable by people. Psychological studies of human learning aspire to understand the mechanisms underlying the various learning behaviors exhibited by people (concept learning, skill acquisition, strategy change, etc.).

Machine learning

Cyber security is that the body of technologies, processes and practices designed to safeguard networks, computers, programs and knowledge from attack, harm or unauthorized access. During a computing context, the term security implies cyber security. This survey paper describes a targeted literature survey of machine learning (ML) and data processing (DM) strategies for cyber analytics in support of intrusion detection. This paper focuses totally on cyber intrusion detection as it applies to wired networks. With a wired network, associate oppose must experience many layers of defense at firewalls and operative systems, or gain physical access to the network. The quality of ML/DM algorithms is addressed, discussion of challenges for victimization ML/DM for cyber security is conferred, and some recommendations on once to use a given methodology area unit provided.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

A survey on cloud computing security

Distributed denial of service (DDoS) resilience in cloud

Twitter has been used as one of the communication channels for spreading breaking news. We propose a method to collect, group, rank and track breaking news in Twitter. Since short length messages make similarity comparison difficult, we boost scores on proper nouns to improve the grouping results. Each group is ranked based on popularity and reliability factors. Current detection method is limited to facts part of messages. We developed an application called “Hotstream” based on the proposed method. Users can discover breaking news from the Twitter timeline. Each story is provided with the information of message originator, story development and activity chart. This provides a convenient way for people to follow breaking news and stay informed with real-time updates.

Breaking News Detection and Tracking in Twitter.

Cloud computing is a more advanced technology for distributed processing, e.g., a thin client and grid computing, which is implemented by means of virtualization technology for servers and storages, and advanced network functionalities. However, this technology has certain disadvantages such as monotonous routing for attacks, easy attack method, and tools. This means that all network resources and operations are blocked all at once in the worst case. Various studies such as pattern analyses and network-based access control for infringement response based on Infrastructure as a Service, Platform as a Service and Software as a Service in cloud computing services have therefore been recently conducted. This study proposes a method of integration between HTTP GET flooding among Distributed Denial-of-Service attacks and MapReduce processing for fast attack detection in a cloud computing environment. In addition, experiments on the processing time were conducted to compare the performance with a pattern detection of the attack features using Snort detection based on HTTP packet patterns and log data from a Web server. The experimental results show that the proposed method is better than Snort detection because the processing time of the former is shorter with increasing congestion.

A method of DDoS attack detection using HTTP packet pattern and rule engine in cloud computing environment

A distributed denial of service attacks are the most serious factor among network security risks in cloud computing environment. This study proposes a method of integration between HTTP GET flooding among DDOS attacks and MapReduce processing for a fast attack detection in cloud computing environment. This method is possible to ensure the availability of the target system for accurate and reliable detection based on HTTP GET flooding. In experiments, the processing time for performance evaluation compares a patten detection of attack features with the Snort detection. The proposed method is better than Snort detection method in experiment results because processing time of proposed method is shorter with increasing congestion.

/pdf/detecting-web-based-ddos-attack-using-mapreduce-operations-3uuoza62az.pdf

Detecting Web based DDoS Attack using MapReduce operations in Cloud Computing Environment.

Text analysis for detecting terrorism-related articles on the web

Large parts of attacks targeting the web are aiming at the weak point of web application. Even though SQL injection, which is the form of XSS Cross Site Scripting attacks, is not a threat to the system to operate the web site, it is very critical to the places that deal with the important information because sensitive information can be obtained and falsified. In this paper, the method to detect themalicious SQL injection script code which is the typical XSS attack using n-Gram indexing and SVM Support Vector Machine is proposed. In order to test the proposed method, the test was conducted after classifying each data set as normal code and malicious code, and the malicious script code was detected by applying index term generated by n-Gram and data set generated by code dictionary to SVM classifier. As a result, when the malicious script code detection was conducted using n-Gram index term and SVM, the superior performance could be identified in detecting malicious script and the more improved results than existing methods could be seen in the malicious script code detection recall.

/pdf/detection-of-cross-site-scripting-attack-in-wireless-32d8z0v9wh.pdf

Detection of cross site scripting attack in wireless networks using n-Gram and SVM

Information spreads much faster through social networking services (SNSs)
 than through traditional news media because users can upload data anytime,
 anywhere. SNSs users are likely to express their emotional status to let
 their friends or other users know how they feel about certain events. This is
 the main reason why many studies have employed social media data to uncover
 hidden facts or issues by analyzing social relationships and reciprocated
 messages between users. The main goal of this study is to discover who is
 isolated, why, and how the issue of social bullying can be addressed through
 an in-depth analysis of negative Tweets. For this, our study takes the basic
 approach by tracking events considered to be exciting by users and then
 analyzing the sentiment status of their Tweets collected between November and
 December 2009 by Stanford University. The results suggest that users tend to
 be happier during evenings than during afternoons. The results also identify
 the precise date of breaking news.

Byeongkyu Ko

Papers

A method of DDoS attack detection using HTTP packet pattern and rule engine in cloud computing environment

Detecting Web based DDoS Attack using MapReduce operations in Cloud Computing Environment.

Text analysis for detecting terrorism-related articles on the web

Detection of cross site scripting attack in wireless networks using n-Gram and SVM

Tracing Trending Topics by Analyzing the Sentiment Status of Tweets