Security and Artificial Intelligence最新文献_第5页

Using spatio-temporal information in API calls with machine learning algorithms for malware detection 利用API调用中的时空信息和机器学习算法进行恶意软件检测

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1655003

F. Ahmed, Haider Hameed, M. Shafiq, M. Farooq

引用次数: 155

Inferring privacy policies for social networking services 推断社交网络服务的隐私政策

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654991

G. Danezis

引用次数: 88

P2P botnet detection using behavior clustering & statistical tests 使用行为聚类和统计测试的P2P僵尸网络检测

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654996

Su-Hua Chang, Thomas E. Daniels

{"title":"P2P botnet detection using behavior clustering & statistical tests","authors":"Su-Hua Chang, Thomas E. Daniels","doi":"10.1145/1654988.1654996","DOIUrl":"https://doi.org/10.1145/1654988.1654996","url":null,"abstract":"Botnets are widely believed to be the most serious danger to the Internet. Most recent research on botnet detection focuses on centralized botnets and primarily relies on two assumptions: prior knowledge of potential C&C channels and capability of monitoring them. However, when botnets switch to a P2P (peer-to-peer) structure and utilize multiple protocols for C&C, the above assumptions no longer hold. Consequently, the detection of P2P botnets is more difficult. In this paper, we relax the above two assumptions and focus on C&C channel detection for P2P botnets that use multiple protocols (randomly chosen) for C&C. We first consider a clustering based node behavior profiling approach to capture the node behavior clusters in a network; we then propose two detection schemes using formal statistical tests on popular behavior clusters in this network. In brief, we detect C&C behavior by measuring its impact on one or more normal behavior clusters in a statistical way. In the initial evaluations, we validate the assumptions made in this paper under different real user traces from enterprise network environments. We then evaluate the proposed approaches to detect the C&C channel in both simple and realistic cases and achieve encouraging results in terms of high detection and low false positive rates.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"242 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133865036","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 43

Active learning for network intrusion detection 网络入侵检测的主动学习

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1655002

Nico Görnitz, M. Kloft, Konrad Rieck, Ulf Brefeld

引用次数: 85

Security challenges for reputation mechanisms using online social networks 使用在线社交网络的声誉机制的安全挑战

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654998

T. Hogg

引用次数: 8

Mixed-initiative security agents 混合主动安全代理

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654999

R. Greenstadt, Sadia Afroz, Michael Brennan

引用次数: 2

Finding "hidden" connections on linkedIn an argument for more pragmatic social network privacy 在领英(linkedIn)上发现“隐藏的”联系，是支持更务实的社交网络隐私的理由

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654992

Jessica Staddon

{"title":"Finding \"hidden\" connections on linkedIn an argument for more pragmatic social network privacy","authors":"Jessica Staddon","doi":"10.1145/1654988.1654992","DOIUrl":"https://doi.org/10.1145/1654988.1654992","url":null,"abstract":"Social networking services well know that some users are unwilling to freely share the information they store with the service (e.g. profile information). To address this, ser vices typically provide various privacy \"knobs\" that the user may adjust to limit access by content type or user identity. However, the main purpose of social networks, community building, is largely at odds with this, hence it is unsurprising that privacy breaches in social networks are increasingly discovered. We argue that this tension between social networking goals and privacy suggests that research efforts should be focused more on efficient methods for detecting privacy breaches in social networks and on building user awareness of privacy risks and the trade-off between privacy and utility. We support our argument with a simple method for discovering LinkedIn contacts ostensibly hidden by privacy settings. This method appears discoverable with a straightforward analysis of the LinkedIn system and its features (indeed, LinkedIn is likely aware of this method), however Linkedin's privacy instructions suggest to users that implementing a privacy setting will prevent such discovery.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134618450","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

A framework for quantitative security analysis of machine learning 机器学习的定量安全分析框架

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654990

P. Laskov, M. Kloft

引用次数: 75

Captcha-free throttling Captcha-free节流

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1654994

M. Jakobsson

引用次数: 5

Keep your friends close: the necessity for updating an anomaly sensor with legitimate environment changes 与你的朋友保持亲密:有必要更新异常传感器与合法的环境变化

Security and Artificial Intelligence Pub Date : 2009-11-09 DOI: 10.1145/1654988.1655000

A. Stavrou, Gabriela F. Cretu-Ciocarlie, M. Locasto, S. Stolfo

{"title":"Keep your friends close: the necessity for updating an anomaly sensor with legitimate environment changes","authors":"A. Stavrou, Gabriela F. Cretu-Ciocarlie, M. Locasto, S. Stolfo","doi":"10.1145/1654988.1655000","DOIUrl":"https://doi.org/10.1145/1654988.1655000","url":null,"abstract":"Large-scale distributed systems have dense, complex code-bases that are assumed to perform multiple and inter-dependent tasks while user interaction is present. The way users interact with systems can differ and evolve over time, as can the systems themselves. Consequently, anomaly detection (AD) sensors must be able to cope with updates to their operating environment. Otherwise, the sensor may incorrectly classify new patterns as malicious (a false positive) or assert that old or outdated patterns are normal (a false negative). This problem of \"model drift\" is an almost universally acknowledged hazard for anomaly sensors. However, relatively little work has been done to understand the process of identifying and seamlessly updating an operational network AD sensor with legal modifications like changes to a file system or back-end database.\u0000 In this paper, we highlight some of the challenges of keeping an anomaly sensor updated, an important step toward helping anomaly sensors become a practical intrusion detection tool for real-world network and host environments. Our goal is to eliminate needless false positives arising from the gradual de-synchronization of the sensor from the environment it is monitoring. To that end, we investigate the feasibility of automatically deriving and applying a \"data\" or \"model patch\" that describes the changes necessary to update a \"reasonable\" AD behavioral model (i.e., a model whose structure follows the core design principles of existing anomaly models). We propose an update procedure that is holistic in nature: specifically, we present preliminary results on how to update a sensor that monitors the request and response messages for non-dynamic HTTP requests and software patches. In addition, we propose extensions for dynamic, database-driven requests and responses.","PeriodicalId":225009,"journal":{"name":"Security and Artificial Intelligence","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132078853","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21