Cyber security is that the body of technologies, processes and practices designed to safeguard networks, computers, programs and knowledge from attack, harm or unauthorized access. During a computing context, the term security implies cyber security. This survey paper describes a targeted literature survey of machine learning (ML) and data processing (DM) strategies for cyber analytics in support of intrusion detection. This paper focuses totally on cyber intrusion detection as it applies to wired networks. With a wired network, associate oppose must experience many layers of defense at firewalls and operative systems, or gain physical access to the network. The quality of ML/DM algorithms is addressed, discussion of challenges for victimization ML/DM for cyber security is conferred, and some recommendations on once to use a given methodology area unit provided.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Principle Component Analysis

Side-Channel Analysis 1.- Attack and Improvement of a Secure S-Box Calculation Based on the Fourier Transform.- Collision-Based Power Analysis of Modular Exponentiation Using Chosen-Message Pairs.- Multiple-Differential Side-Channel Collision Attacks on AES.- Implementations 1.- Time-Area Optimized Public-Key Engines: -Cryptosystems as Replacement for Elliptic Curves?.- Ultra High Performance ECC over NIST Primes on Commercial FPGAs.- Exploiting the Power of GPUs for Asymmetric Cryptography.- Fault Analysis 1.- High-Performance Concurrent Error Detection Scheme for AES Hardware.- A Lightweight Concurrent Fault Detection Scheme for the AES S-Boxes Using Normal Basis.- RSA with CRT: A New Cost-Effective Solution to Thwart Fault Attacks.- Random Number Generation.- A Design for a Physical RNG with Robust Entropy Estimators.- Fast Digital TRNG Based on Metastable Ring Oscillator.- Efficient Helper Data Key Extractor on FPGAs.- Side-Channel Analysis 2.- The Carry Leakage on the Randomized Exponent Countermeasure.- Recovering Secret Keys from Weak Side Channel Traces of Differing Lengths.- Attacking State-of-the-Art Software Countermeasures-A Case Study for AES.- Cryptography and Cryptanalysis.- Binary Edwards Curves.- A Real-World Attack Breaking A5/1 within Hours.- Hash Functions and RFID Tags: Mind the Gap.- Implementations 2.- A New Bit-Serial Architecture for Field Multiplication Using Polynomial Bases.- A Very Compact Hardware Implementation of the MISTY1 Block Cipher.- Light-Weight Instruction Set Extensions for Bit-Sliced Cryptography.- Fault Analysis 2.- Power and Fault Analysis Resistance in Hardware through Dynamic Reconfiguration.- RFID and Its Vulnerability to Faults.- Perturbating RSA Public Keys: An Improved Attack.- Side-Channel Analysis 3.- Divided Backend Duplication Methodology for Balanced Dual Rail Routing.- Using Subspace-Based Template Attacks to Compare and Combine Power and Electromagnetic Information Leakages.- Mutual Information Analysis.- Invited Talks.- RSA-Past, Present, Future.- A Vision for Platform Security.

Cryptographic hardware and embedded systems : CHES 2008 : 10th International Workshop, Washington, D.C., USA, August 10-13, 2008 : proceedings

PCA filtering and probabilistic SOM for network intrusion detection

We design a space efficient algorithm that approximates the transitivity (global clustering coefficient) and total triangle count with only a single pass through a graph given as a stream of edges. Our procedure is based on the classic probabilistic result, the birthday paradox. When the transitivity is constant and there are more edges than wedges (common properties for social networks), we can prove that our algorithm requires O(√n) space (n is the number of vertices) to provide accurate estimates. We run a detailed set of experiments on a variety of real graphs and demonstrate that the memory requirement of the algorithm is a tiny fraction of the graph. For example, even for a graph with 200 million edges, our algorithm stores just 60,000 edges to give accurate results. Being a single pass streaming algorithm, our procedure also maintains a real-time estimate of the transitivity/number of triangles of a graph, by storing a miniscule fraction of edges.

A space efficient streaming algorithm for triangle counting using the birthday paradox

In the modern life, SMS (Short Message Service) is one of the most neces- sary services on mobile devices. Because of its popularity, many companies use SMS as an effective marketing and advertising tool. Also, the popularity gives hackers chances to abuse SMS to cheat mobile users and steal personal information in their mobile phones, for example. In this paper, we propose a method to detect spam SMS on mobile devices and smart phones. Our approach is based on improving a graph-based algorithm and utilizing the KNN Algorithm - one of the simplest and most effective clas- sification algorithms. The experimentation is carried out on SMS message collections and the results ensures the efficiency of the proposed method, with high accuracy and small processing time enough for detecting spam messages directly on mobile phones in real time.

Graph-based KNN Algorithm for Spam SMS Detection

Yaron Sella recently proposed a scalable version of Jakobsson’s algorithm to traverse a hash chain of size n. Given the hash chain and a computation limit m (k=m+1 and \(b=\sqrt[k]{n}\)), Sella’s algorithm traverses the hash chain using a total of kb memory. We improve the memory usage to k(b-1). Because efficient hash chain traversal algorithms are aimed at devices with severely restricted computation and memory requirements, a reduction by a factor of (b-1)/b is considered to be important. Further, our algorithm matches the memory requirements of Jakobsson’s algorithm while still remaining scalable. Sella’s algorithm, when scaled to the case of Jakobsson’s algorithm, has a memory requirement of about twice that of Jakobsson’s.

/pdf/improved-scalable-hash-chain-traversal-1c9ypesil6.pdf

Improved Scalable Hash Chain Traversal

Effect of loading rate on the pullout capacity of offshore bucket foundations in sand

IP Traceback is a way to search for sources of damage to the network or host computer. IP Traceback method consists of reactive and proactive methods, and the proactive method induces a serious storage overhead. However, a system capable of solving these problems through cluster-based mass storage, digestible packets and hierarchical collections was designed. It not only performs traceback but also communicates with analysis data of other security systems by using the logging methods. It is capable of performing an effective traceback operation by using data mining in order to perform vast amount of traceback operation with the use of massive data. In addition, the results can be used as basic data to generate new rules for intrusion detection systems.

A New Logging-based IP Traceback Approach using Data Mining Techniques.

PCA (Principal Component Analysis) is one of the most wildly used dimension reduction technique, which is often applied to identify patterns in complex data of high dimension [1]. In GA-KM [2], we have proposed GA-KM algorithm and have experimented using KDD-99 data set. The result showed GA-KM is efficient for intrusion detection. However, due to the hugeness of the data set, the experiment needs to take a long time to finish. To solve this deficiency, we combine PCA and GA-KM in this paper. The goal of PCA is to remove unimportant information like the noise in data sets which have high dimension, and retain the variation present in the original dataset as much as possible. The experimental results show that, compared to GA-KM [2], the proposed method is better in computational expense and time (through dimension reduction) and is also better in intrusion detection ratios (through noise reduction).

/pdf/improved-clustering-for-intrusion-detection-by-principal-4dtgmbhk1s.pdf

Sung-Ryul Kim

Papers

Graph-based KNN Algorithm for Spam SMS Detection

Improved Scalable Hash Chain Traversal

Effect of loading rate on the pullout capacity of offshore bucket foundations in sand

A New Logging-based IP Traceback Approach using Data Mining Techniques.

Improved clustering for intrusion detection by principal component analysis with effective noise reduction