Applications of Data Mining in Computer Security

Dr. Sushil Jajodia is Professor and Chairman of the Dept. of Information and Software Engineering, and Director of the Center for Secure Information Systems at the George Mason University, Fairfax, Virginia, USA

• 1 Modern Intrusion Detection, Data Mining, and Degrees of Attack Guilt.- 1. Introduction.- 2. Detection Strategies.- 3. Data Sources.- 4. Degrees of Attack Guilt.- 5. Conclusion.- References.- 2 Data Mining for Intrusion Detection.- 1. Introduction.- 2. Data Mining Basics.- 3. Data Mining Meets Intrusion Detection.- 4. Observations on the State of the Art.- 5. Future Research Directions.- 6. Summary.- References.- 3 An Architecture for Anomaly Detection.- 1. Introduction.- 2. Architecture.- 3. ADAM: an implementation of the architecture.- 4. Experiences.- 5. Breaking the dependency on training data.- 6. Future.- References.- 4 A Geometric Framework for Unsupervised Anomaly Detection.- 1. Introduction.- 2. Unsupervised Anomaly Detection.- 3. A Geometric Framework for Unsupervised Anomaly Detection.- 4. Detecting Outliers in Feature Spaces.- 5. Algorithm 1: Cluster-based Estimation.- 6. Algorithm 2: K-nearest neighbor.- 7. Algorithm 3: One Class SVM.- 8. Feature Spaces for Intrusion Detection.- 9. Experiments.- 10. Discussion.- References.- 5 Fusing a Heterogeneous Alert Stream into Scenarios.- 1. Introduction.- 2. Fusion Approach.- 3. Architecture.- 4. Definitions.- 5. Probability Assignment.- 6. Experimental Results.- 7. System Benefits.- 8. Discussion and Summary.- References.- 6 Using MIB II Variables for Network Intrusion Detection.- 1. Introduction.- 2. Background.- 3. Model Construction.- 4. Experiments and Performance Evaluation.- 5. Discussion.- 6. Related Work.- 7. Conclusions and Future Work.- References.- 7 Adaptive Model Generation.- 1. Introduction.- 2. Components of Adaptive Model Generation.- 3. Capabilities of Adaptive Model Generation.- 4. Model Generation Algorithms.- 5. Model Generation Example: SVM.- 6. System Example 1: Registry Anomaly Detection.- 7. System Example 2: HAUNT.- 8. Conclusion.- References.- 8 Proactive Intrusion Detection.- 1. Introduction.- 2. Information Assurance, Data Mining, and Proactive Intrusion Detection.- 3. A methodology for discovering precursors - Assumptions, Ob-jectives, Procedure and Analysis.- 4. A Case Study - Precursor Rules for Distributed Denial of Ser-vice Attacks.- 5. Conclusions.- References.- 9 E-mail Authorship Attribution for Computer Forensics.- 1. Introduction and Motivation.- 2. Authorship Attribution.- 3. E-mail Authorship Attribution.- 4. Support Vector Machine Classifier.- 5. E-mail Corpus and Methodology.- 6. Results and Discussion.- 7. Conclusions.- References.