Online and Adaptive Signature Learning for Intrusion Detection

ISBN-13: 9783639136302 / Angielski / Miękka / 2009 / 284 str.

Kamran Shafi

Opis

This thesis presents the case of dynamically and adaptively learning signatures for network intrusion detection using genetic based machine learning techniques. The two major criticisms of thesignature based intrusion detection systems are their i) reliance on domain experts to handcraft intrusion signatures and ii) inability to detect previously unknown attacks or the attacks for which no signatures are available at the time. In this thesis, we present a biologically-inspired computational approach to address these two issues. This is done by adaptively learning maximally general rules, which are referred to as signatures, from network traffic through a supervised learningclassifier system. The rules are learnt dynamically (i.e., using machine intelligence and without the requirement of a domain expert), and adaptively (i.e., as the data arrives without the need to relearn the complete model after presenting each data instance to the current model). Our approach is hybrid in that signatures for both intrusive and normal behaviours are learnt.

O autorze

Kamran Shafi is a Research Associate at UNSW@ADFA, Canberra,
Australia. He holds a PhD in Computer Science, a MEngSc in
Telecoms and a BSc in EE degrees. His PhD thesis was awarded the
Stephen Fester Award for the most outstanding thesis on an
information technology topic by a postgraduate research student
in the School of ITEE.