Cyber security is that the body of technologies, processes and practices designed to safeguard networks, computers, programs and knowledge from attack, harm or unauthorized access. During a computing context, the term security implies cyber security. This survey paper describes a targeted literature survey of machine learning (ML) and data processing (DM) strategies for cyber analytics in support of intrusion detection. This paper focuses totally on cyber intrusion detection as it applies to wired networks. With a wired network, associate oppose must experience many layers of defense at firewalls and operative systems, or gain physical access to the network. The quality of ML/DM algorithms is addressed, discussion of challenges for victimization ML/DM for cyber security is conferred, and some recommendations on once to use a given methodology area unit provided.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Principle Component Analysis

Side-Channel Analysis 1.- Attack and Improvement of a Secure S-Box Calculation Based on the Fourier Transform.- Collision-Based Power Analysis of Modular Exponentiation Using Chosen-Message Pairs.- Multiple-Differential Side-Channel Collision Attacks on AES.- Implementations 1.- Time-Area Optimized Public-Key Engines: -Cryptosystems as Replacement for Elliptic Curves?.- Ultra High Performance ECC over NIST Primes on Commercial FPGAs.- Exploiting the Power of GPUs for Asymmetric Cryptography.- Fault Analysis 1.- High-Performance Concurrent Error Detection Scheme for AES Hardware.- A Lightweight Concurrent Fault Detection Scheme for the AES S-Boxes Using Normal Basis.- RSA with CRT: A New Cost-Effective Solution to Thwart Fault Attacks.- Random Number Generation.- A Design for a Physical RNG with Robust Entropy Estimators.- Fast Digital TRNG Based on Metastable Ring Oscillator.- Efficient Helper Data Key Extractor on FPGAs.- Side-Channel Analysis 2.- The Carry Leakage on the Randomized Exponent Countermeasure.- Recovering Secret Keys from Weak Side Channel Traces of Differing Lengths.- Attacking State-of-the-Art Software Countermeasures-A Case Study for AES.- Cryptography and Cryptanalysis.- Binary Edwards Curves.- A Real-World Attack Breaking A5/1 within Hours.- Hash Functions and RFID Tags: Mind the Gap.- Implementations 2.- A New Bit-Serial Architecture for Field Multiplication Using Polynomial Bases.- A Very Compact Hardware Implementation of the MISTY1 Block Cipher.- Light-Weight Instruction Set Extensions for Bit-Sliced Cryptography.- Fault Analysis 2.- Power and Fault Analysis Resistance in Hardware through Dynamic Reconfiguration.- RFID and Its Vulnerability to Faults.- Perturbating RSA Public Keys: An Improved Attack.- Side-Channel Analysis 3.- Divided Backend Duplication Methodology for Balanced Dual Rail Routing.- Using Subspace-Based Template Attacks to Compare and Combine Power and Electromagnetic Information Leakages.- Mutual Information Analysis.- Invited Talks.- RSA-Past, Present, Future.- A Vision for Platform Security.

Cryptographic hardware and embedded systems : CHES 2008 : 10th International Workshop, Washington, D.C., USA, August 10-13, 2008 : proceedings

PCA filtering and probabilistic SOM for network intrusion detection

We design a space efficient algorithm that approximates the transitivity (global clustering coefficient) and total triangle count with only a single pass through a graph given as a stream of edges. Our procedure is based on the classic probabilistic result, the birthday paradox. When the transitivity is constant and there are more edges than wedges (common properties for social networks), we can prove that our algorithm requires O(√n) space (n is the number of vertices) to provide accurate estimates. We run a detailed set of experiments on a variety of real graphs and demonstrate that the memory requirement of the algorithm is a tiny fraction of the graph. For example, even for a graph with 200 million edges, our algorithm stores just 60,000 edges to give accurate results. Being a single pass streaming algorithm, our procedure also maintains a real-time estimate of the transitivity/number of triangles of a graph, by storing a miniscule fraction of edges.

A space efficient streaming algorithm for triangle counting using the birthday paradox

In this paper, a new learning algorithm for adaptive network intrusion detection using principal component analysis, decision tree and Naive Bayesian classifier is presented. First we use PCA (Principal Component Analysis) to remove unimportant information like the noise in the data sets, to reduce the dimension, and to retain the important information as much as possible. Then we use the Decision tree and Naive Bayesian algorithm to make Intrusion Detection Model. We have tested the performance of our proposed algorithm on the KDD99 benchmark intrusion detection dataset. The experimental result prove that the proposed algorithm achieved high detection rates (DR), low false positive (FP) and low false negative (FN) for different types of network intrusions.

Combining principal component analysis, decision tree and naïve Bayesian algorithm for adaptive intrusion detection

In recent years, rapid advancement of internet and communication technologies as a way of social communications has emerged as the SNS. This way of communication needs social data analysis method for the meaningful information. In addition, rapidly increasing social data causes the lack of reliability of the information in the community. Therefore, an effective semantic analysis method is required. This paper proposed a Large-scalable Social Data Analysis System and evaluated it. The proposed system consists of two parts: social data gathering agent module and social data analysis module. The main role of gathering agent is to collect text type's data from SNS with gigabyte unit. Improved TF_IDF and Weighted-MINAX are used for semantic analysis of collected social data from the gathering agent. Thus, the improved social data analysis module supports meaningful information service which contains high priority words. We implemented the improved social data analysis module that uses Hadoop MapReduce programing model. In addition, we evaluated large-scalable social data analysis system in terms of processing time and accuracy.

Implementation of a Large-Scalable Social Data Analysis System Based on MapReduce

In this paper we consider general simulations of algorithms designed for fully operational BSP and CGM machines on machines with faulty processors. The faults are deterministic (i.e., worst-case distributions of faults are considered) and static (i.e., they do not change in the course of computation). We assume that a constant fraction of processors are faulty. We present a deterministic simulation (resp. a randomized simulation) that achieves constant slowdown per local computations and O((log/sub h/ p)/sup 2/) (resp. O(log/sub h/ p)) slowdown per communication round, provided that a deterministic preprocessing is done that requires O((log/sub h/ p)/sup 2/) communication rounds and linear (in h) computation per processor in each communication round. Our results are fully-scalable over all values of p from /spl theta/(1) to /spl theta/(n). Furthermore, our results imply that for p/spl les/n/sup /spl epsi// (/spl epsiv/<1), algorithms can be made resilient to a constant fraction of processor faults without any asymptotic slowdown.

Fully-scalable fault-tolerant simulations for BSP and CGM

Consider the two-dimensional sorted-set convex hull problem: Given N points in a plane sorted by the x coordinates, compute the convex hull of the points. We propose an O(logNloglogN)-time algorithm that solves the sorted-set convex hull problem on an N^(l/2)×N^(1/2) reconfigurable mesh. The best known algorithm for the problem on an N^(l/2)×N^(1/2) reconfigurable mesh takes 0(1og²N) time. Although there is a constant-time algorithm on an N×N reconfigurable mesh for the general two-dimensional convex hull problem, the general convex hull problem requires θ(N^(l/2)) time on an N^(l/2)×N^(1/2) reconfigurable mesh due to bandwidth constraints.

An Efficient Convex Hull Algorithm on the Reconfigurable Mesh

In World Wide Web search engines, it is important to have a good ranking system. One of the most famous ranking components is the PageRank system by Google. However, PageRank is protected by patents and it is impossible for other companies to use it in their search engines. There is an old model, called Katz status index, that is reported to work very similar to PageRank. If the quality of Katz status index turns out to be similar to or better than that of PageRank, it could become a patent-free alternative to PageRank. We consider the problem of comparing Katz status index to PageRank in this paper with some preliminary results on the theoretical comparison and give a proposal for practical comparison of the two models.

Sung-Ryul Kim

Papers

Combining principal component analysis, decision tree and naïve Bayesian algorithm for adaptive intrusion detection

Implementation of a Large-Scalable Social Data Analysis System Based on MapReduce

Fully-scalable fault-tolerant simulations for BSP and CGM

An Efficient Convex Hull Algorithm on the Reconfigurable Mesh

PageRank vs. Katz Status Index, a Theoretical Approach