Network traffic based computer system user identification Dr Zsolt Illési associate professor College of Dunaújváros Open Source Intelligence.

Slides:

Advertisements

Similar presentations

Intrusion Detection Systems (I) CS 6262 Fall 02. Definitions Intrusion Intrusion A set of actions aimed to compromise the security goals, namely A set.

Advertisements

F3 Collecting Network Based Evidence (NBE)

Rulebase Expert System and Uncertainty. Rule-based ES Rules as a knowledge representation technique Type of rules :- relation, recommendation, directive,

Background Reinforcement Learning (RL) agents learn to do tasks by iteratively performing actions in the world and using resulting experiences to decide.

Hidden Markov Models Reading: Russell and Norvig, Chapter 15, Sections

Data Mining Glen Shih CS157B Section 1 Dr. Sin-Min Lee April 4, 2006.

Anomaly Based Intrusion Detection System

1 Cryptography and Network Security Third Edition by William Stallings Lecturer: Dr. Saleem Al_Zoubi.

1.  To analyze and explain the IDS placement in network topology  To explain the relationship between honey pots and IDS  To explain, analyze and evaluate.

Report on Intrusion Detection and Data Fusion By Ganesh Godavari.

Mining Behavior Models Wenke Lee College of Computing Georgia Institute of Technology.

National Institute of Standards and Technology Computer Security Division Information Technology Laboratory Threat Information Sharing; Perspectives, Strategies,

Intrusion Detection Systems. Definitions Intrusion –A set of actions aimed to compromise the security goals, namely Integrity, confidentiality, or availability,

DASHBOARDS Dashboard provides the managers with exactly the information they need in the correct format at the correct time. BI systems are the foundation.

Department Of Computer Engineering

Network Simulation Internet Technologies and Applications.

Key-Stroke Timing and Timing Attack on SSH Yonit Shabtai and Michael Lustig supervisor: Yoram Yihyie Technion - Israel Institute of Technology Computer.

Intrusion and Anomaly Detection in Network Traffic Streams: Checking and Machine Learning Approaches ONR MURI area: High Confidence Real-Time Misuse and.

Lucent Technologies – Proprietary Use pursuant to company instruction Learning Sequential Models for Detecting Anomalous Protocol Usage (work in progress)

Data Mining. 2 Models Created by Data Mining Linear Equations Rules Clusters Graphs Tree Structures Recurrent Patterns.

Data Mining Chun-Hung Chou

Cyber vs Legislation and Ethics Colonel John Doody Panel Chair.

Introduction The large amount of traffic nowadays in Internet comes from social video streams. Internet Service Providers can significantly enhance local.

Chapter 8 Prediction Algorithms for Smart Environments

Data Management Turban, Aronson, and Liang Decision Support Systems and Intelligent Systems, Seventh Edition.

Last Words COSC Big Data (frameworks and environments to analyze big datasets) has become a hot topic; it is a mixture of data analysis, data mining,

COEN 252 Computer Forensics

IIT Indore © Neminah Hubballi

Tennessee Technological University1 The Scientific Importance of Big Data Xia Li Tennessee Technological University.

CIS 9002 Kannan Mohan Department of CIS Zicklin School of Business, Baruch College.

INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION INTRUSION DETECTION.

Dr Richard Overill Department of Informatics King’s College London Cyber Sleuthing or the Art of the Digital Detective.

COEN 252 Computer Forensics Collecting Network-based Evidence.

Artificial Intelligence in Gaming Riley Turben. Game AI  Differ from a “traditional” AI  Scope of knowledge  Varying complexity  A substitute for.

Data Mining Techniques in Stock Market Prediction

Bayesian networks Classification, segmentation, time series prediction and more. Website: Twitter:

Voice Recognition All Talk No Walk.

Report on Intrusion Detection and Data Fusion By Ganesh Godavari.

Defining Procedures for Decision Analysis May & Engr A April 30, 2002 Client & Faculty Advisors –Dr. Keith Adams –Dr. John Lamont –Dr. Ralph.

© 2001 by Carnegie Mellon University SS5 -1 OCTAVE SM Process 5 Background on Vulnerability Evaluations Software Engineering Institute Carnegie Mellon.

Data Mining Knowledge on rough set theory SUSHIL KUMAR SAHU.

Bayesian Networks for Data Mining David Heckerman Microsoft Research (Data Mining and Knowledge Discovery 1, (1997))

Linux Networking and Security

Ihr Logo Chapter 5 Business Intelligence: Data Warehousing, Data Acquisition, Data Mining, Business Analytics, and Visualization Turban, Aronson, and Liang.

Mapping Internet Sensors with Probe Response Attacks Authors: John Bethencourt, Jason Franklin, Mary Vernon Published At: Usenix Security Symposium, 2005.

Gaining Cyber Situation Awareness in Enterprise Networks: A Systems Approach Peng Liu, Xiaoyan Sun, Jun Dai Penn State University ARO Cyber Situation Awareness.

Last Words DM 1. Mining Data Steams / Incremental Data Mining / Mining sensor data (e.g. modify a decision tree assuming that new examples arrive continuously,

Chapter 5: Business Intelligence: Data Warehousing, Data Acquisition, Data Mining, Business Analytics, and Visualization DECISION SUPPORT SYSTEMS AND BUSINESS.

Alexey A. Didyk Kherson national technical university, Ukraine

Automatic Detection of Emerging Threats to Computer Networks Andre McDonald.

Workpackage 3 New security algorithm design ICS-FORTH Ipswich 19 th December 2007.

The Intersection of Computer Interaction and Software Models A “5 by 5” Non-functional Performance Matrix Tom Hill Summer 2005 CS 6362.

1 Introduction to Data Mining C hapter 1. 2 Chapter 1 Outline Chapter 1 Outline – Background –Information is Power –Knowledge is Power –Data Mining.

Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Network Forensics - III November 3, 2008.

International Cyber Warfare & Security and B2B Conference Participation of Brazilian Cyber Defense Centre ( )

Intrusion Detection System

DATA MINING PREPARED BY RAJNIKANT MODI REFERENCE:DOUG ALEXANDER.

Data Resource Management Agenda What types of data are stored by organizations? How are different types of data stored? What are the potential problems.

WHAT IS DATA MINING?  The process of automatically extracting useful information from large amounts of data.  Uses traditional data analysis techniques.

A Blackboard-Based Learning Intrusion Detection System: A New Approach

1 Network Security: Introduction Behzad Akbari Fall 2009 In the Name of the Most High.

1 INSTYTUT PODSTAW INFORMATYKI PAN OR INSTITUTE OF COMPUTER SCIENCE, POLISH ACAD. SCI. (56 scientists, including 49 Ph.D.’s) IN THE FOLLOWING AREAS: OFFER.

Decision Support and Business Intelligence Systems (9 th Ed., Prentice Hall) Chapter 12: Artificial Intelligence and Expert Systems.

Spring 2003 Dr. Susan Bridges

RESEARCH APPROACH.

Implementing Boosting and Convolutional Neural Networks For Particle Identification (PID) Khalid Teli .

An Enhanced Support Vector Machine Model for Intrusion Detection

Timing Analysis of Keystrokes And Timing Attacks on SSH

C.U.SHAH COLLEGE OF ENG. & TECH.

Identifying Slow HTTP DoS/DDoS Attacks against Web Servers DEPARTMENT ANDDepartment of Computer Science & Information SPECIALIZATIONTechnology, University.

Presentation transcript:

Network traffic based computer system user identification Dr Zsolt Illési associate professor College of Dunaújváros Open Source Intelligence Areas of Development

Key Questions of Detection Provide Information About Who? (individual(s) involved) When? (timeline) What? (nature of events) Where? (scene) Why? (motivation) How? (used tools/ exploits) Open Source Intelligence Areas of Development

Incident Lifecycle Open Source Intelligence Areas of Development

Network Situational Awareness Cyber Attack Scenarios Situation-Aware and Context-Aware Network Applications CERTs and CSIRTs Security Event and Information Management Application Security, Audits and Penetration Testing Open Source Intelligence Areas of Development

Web Traffic Characterisation Intrusion Detection Systems Traffic Characterisation Techniques Web Analytics Security Incident Response Open Source Intelligence Areas of Development

Cyber Situational Awareness Tools & Techniques Fuzzy Logic Rough Set Artificial Neural Networks Artificial Intelligence Genetic Algorithm Evidence Theory (DST) Bayesian Networks & Set Theory Big Data Analytics Game Theory Graph Theory Open Source Intelligence Areas of Development

Identifying someone Prove that a signature is from a known person Prove that some network traffic is generated by a specific user Open Source Intelligence Areas of Development

Bayesian interpretation of network data Open Source Intelligence Areas of Development posterior knowledge new data prior knowledge posterior odds likehood ratio prior odds

Identification of WHO using a computer? (Assumptions) User(s) in action – one or more person – one or more computer system – carefully defined (limited) task performance Used network data – generic protocol data are available – payload (e.g. data) possibly encrypted Previous information (reference data model is available) Open Source Intelligence Areas of Development

Identification of WHO using a computer? (Tools) Network taps (specialised hardware or active network tool) Sniffers, and network traffic/data analysers (wireshark, tcpdump, tcpstat, tcptrace, CoralReef etc.) Scripting language for data pre-processing (Python, Pearl etc.) Number cruncher (Octave, Scilab, Matlab, Mathematica etc.) Open Source Intelligence Areas of Development

Identification of WHO using a computer? (Stages) Reference data network usage data collection (prior probability distribution) Definine the probability that a certain person (or computer system) uses the network (hypothesis testing; posterior distribution analysis) Open Source Intelligence Areas of Development

Identification of WHO using a computer? (Process) Raw network data collection Understand network data ( – packet sorting and analysis – data-flow and protocol statistics – network connection (source-destination pairing) Bayesian analysis (current data vs reference data) Open Source Intelligence Areas of Development

Pro’s and Con’s Constraints Single user No other (significant) interference to computer traffic (e.g background software activity) lack of adequate amount of reference data (directed network usage) Benefits 80%+ accuracy (pls consider the limitations!!!) Open Source Intelligence Areas of Development

Future development — Experiment Scope Greater reference data – number of persons – duration of network usage – mixed data with some other subjects Combine with logs (apply the results to log analisis fileld and enhance accuracy) Open Source Intelligence Areas of Development

Future Developments — Combined approach Hidden Markov model Gaussian mixture models Fuzzy Logic Artificial Neural Networks Data Mining Decision Trees Graph Theory etc. Open Source Intelligence Areas of Development