Machine Learning and Data Mining for Computer Security: Methods and Applications (Advanced Information and Knowledge Processing)

The Internet began as a private network connecting government, military, and academic researchers. As such, there was little need for secure protocols, encrypted packets, and hardened servers. When the creation of the World Wide Web unexpectedly ushered in the age of the commercial Internet, the network's size and subsequent rapid expansion made it impossible retroactively to apply secure mechanisms. The Internet's architects never coined terms such as **spam**, **phishing**, **zombies**, and **spyware**, but they are terms and phenomena we now encounter constantly. Programming detectors for such threats has proven difficult. Put simply, there is too much information---too many protocols, too many layers, too many applications, and too many uses of these applications---for anyone to make sufficient sense of it all. Ironically, given this wealth of information, there is also too little information about what is important for detecting attacks. Methods of machine learning and data mining can help build better detectors from massive amounts of complex data. Such methods can also help discover the information required to build more secure systems. For some problems in computer security, one can directly apply machine learning and data mining techniques. Other problems, both current and future, require new approaches, methods, and algorithms. This book presents research conducted in academia and industry on methods and applications of machine learning and data mining for problems in computer security and will be of interest to researchers and practitioners, as well students. **‘Dr. Maloof not only did a masterful job of focusing the book on a critical area that was in dire need of research, but he also strategically picked papers that complemented each other in a productive manner. ... This book is a must read for anyone interested in how research can improve computer security.’** **__Dr Eric Cole, Computer Security Expert__** The Internet began as a private network connecting government, military, and academic researchers. As such, there was little need for secure protocols, encrypted packets, and hardened servers. When the creation of the World Wide Web unexpectedly ushered in the age of the commercial Internet, the network's size and subsequent rapid expansion made it impossible retroactively to apply secure mechanisms. The Internet's architects never coined terms such as spam, phishing, zombies, and spyware, but they are terms and phenomena we now encounter constantly. Programming detectors for such threats has proven difficult. Put simply, there is too much information -- too many protocols, too many layers, too many applications, and too many uses of these applications -- for anyone to make sufficient sense of it all. Ironically, given this wealth of information, there is also too little information about what is important for detecting attacks. Methods of machine learning and data mining can help build better detectors from massive amounts of complex data. Such methods can also help discover the information required to build more secure systems. For some problems in computer security, one can directly apply machine learning and data mining techniques. Other problems, both current and future, require new approaches, methods, and algorithms. This book presents research conducted in academia and industry on methods and applications of machine learning and data mining for problems in computer security and will be of interest to researchers and practitioners, as well students. 'Dr. Maloof not only did a masterful job of focusing the book on a critical area that was in dire need of research, but he also strategically picked papers that complemented each other in a productive manner. ... This book is a must read for anyone interested in how research can improve computer security.' Dr Eric Cole, Computer Security Expert

Machine Learning and Data Mining for Computer Security provides an overview of the current state of research in machine learning and data mining as it applies to problems in computer security. This book has a strong focus on information processing and combines and extends results from computer security.

The first part of the book surveys the data sources, the learning and mining methods, evaluation methodologies, and past work relevant for computer security. The second part of the book consists of articles written by the top researchers working in this area. These articles deals with topics of host-based intrusion detection through the analysis of audit trails, of command sequences and of system calls as well as network intrusion detection through the analysis of TCP packets and the detection of malicious executables.

This book fills the great need for a book that collects and frames work on developing and applying methods from machine learning and data mining to problems in computer security.

"Machine Learning and Data Mining for Computer Security" provides an overview of the current state of research in machine learning and data mining as it applies to problems in computer security. This book has a strong focus on information processing and combines and extends results from computer security. The first part of the book surveys the data sources, the learning and mining methods, evaluation methodologies, and past work relevant for computer security. The second part of the book consists of articles written by the top researchers working in this area. These articles deals with topics of host-based intrusion detection through the analysis of audit trails, of command sequences and of system calls as well as network intrusion detection through the analysis of TCP packets and the detection of malicious executables. This book fills the great need for a book that collects and frames work on developing and applying methods from machine learning and data mining to problems in computer security. Introduction....Pages 1-3 An Introduction to Information Assurance....Pages 7-21 Some Basic Concept of Machine Learning and Data Mining....Pages 23-43 Learning to Detect Malicious Executables....Pages 47-63 Data Mining Applied to Intrusion Detection: MITRE Experiences....Pages 65-88 Intrusion Detection Alarm Clustering....Pages 89-106 Behavioral Features for Network Anomaly Detection....Pages 107-124 Cost-Sensitive Modeling for Intrusion Detection....Pages 125-136 Data Cleaning and Enriched Representations for Anomaly Detection in System Calls....Pages 137-156 A Decision-Theoritic, Semi-Supervised Model for Intrusion Detection....Pages 157-177