http://dtstc.ugr.es/~jedv/descargas/2009_CoSe09-Anomaly-based-network-intrusion-detection-Techniques,-systems-and-challenges.pdf

Anomaly-based network intrusion detection: Techniques, systems and challenges

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

An overview of anomaly detection techniques: Existing solutions and latest technological trends

The Transmission Control Protocol.

Review: Intrusion detection system: A comprehensive review

A low-rate DoS attack to iterative servers has recently appeared as a new approach for defeating services using rates of traffic that could be adjusted to bypass security detection mechanisms. Although the fundamentals and effectiveness of these kind of attacks are known, it is not clear how to design the attack to achieve specific constraints based on the used rate and the efficiency in denial of service obtained. In this paper 1 , a comprehensive mathematical framework that models the behaviour of the attack is presented. The main contribution of this model is to give a better understanding of the dynamics of these kind of attacks, in order to facilitate the development of detection and defense mechanisms.

Mathematical foundations for the design of a low-rate DoS attack to iterative servers (short paper)

This paper presents a new framework developed to apply Alphanets to CSR. For this purpose, a modular system is proposed. This system is made up by three different modules: LVQ module, SLHMM module and DP module. The SLHMM module is an expansion of an Alphanet, and therefore, can be interpreted as a HMM. The system can be trained globally applying backpropagation techniques. The used pruning procedure is based upon recognized units instead of observations, which reduces the number of nodes needed to recognize a sentence, compared to HMM-based systems using the same parameters for the models in both systems. Besides, the training procedure re-adapts the weights according to the new architecture in a few iterations since the initial parameters can be estimated from a classical HMM CSR system. >

SLHMM: a continuous speech recognition system based on Alphanet-HMM

Este trabajo ha sido parcialmente financiado por el Gobierno Espanol-MINECO (Ministerio de Economia y Competitividad) y fondos FEDER, a traves del proyecto TIN2014-60346-R

/pdf/ugr-16-un-nuevo-conjunto-de-datos-para-la-evaluacion-de-ids-20qrt3aae2.pdf

UGR’16: Un nuevo conjunto de datos para la evaluación de IDS de red

The identification of P2P traffic has become a principal concern for the research community in the last years. Although several P2P traffic identification proposals can be found in the specialized literature, the problem still persists mainly due to obfuscation and privacy matters. This paper presents a flow-based P2P traffic identification scheme which is based on a multiple classification procedure. First, every traffic flow monitored is parameterized by using three different groups of features: time related features, data transfer features and signalling features. After that, a flow identification process is performed for each group of features. Finally, a global identification procedure is carried out by combining the three individual classifications. Promising experimental results have been obtained by using a basic KNN scheme as the classifier. These results provide some insights on the relevance of the group of features considered and demonstrate the validity of our approach to identify P2P traffic in a reliable way, while content inspection is avoided.

Multiple vector classification for p2p traffic identification

The great impact and growth of P2P networks in recent years make them an interesting target for hackers. But the development of P2P is aimed at improving the behavior of the networks, in computational terms, or to hide the transactions from observers. Security in P2P networks has been usually undervalued and not taken into account. This paper tries to highlight the major topics and challenges regarding P2P security, from a network infrastructure point of view (environmental security), providing some insights in current developments and available techniques that could be used to solve those problems.

Pedro García-Teodoro

Papers

Mathematical foundations for the design of a low-rate DoS attack to iterative servers (short paper)

SLHMM: a continuous speech recognition system based on Alphanet-HMM

UGR’16: Un nuevo conjunto de datos para la evaluación de IDS de red

Multiple vector classification for p2p traffic identification

Environmental Security in P2P Networks