MLSEC 5 Flashcards
Attack
attempt to compromise the CIA of resources or information
Intrusion Detection System (IDS)
a system monitoring a stream of events for attacks
Differentiation of IDS
Event source
Analysis type
Response type
Identification of attacks using signatures
Detection patterns
from known attacks
Frequent updates
Drawbacks of Signatures
Delay from discovery
Unable to scale with complexity
Ineffective against unknown attacks
Machine Learning for IDS
Effectivity: good detection with few very false alarms
Efficiency: processing of several megabytes per second
Robustness: resistance against evasion attempts
Different approaches for learning-based intrusion detection
Modeling of malicious activity only
Modeling of benign activity only
Differences between malicious and benign activity
IDS Architecture
Monitoring
Analysis
Detection
Response
Numerical Features
Mapping of events to a vector space
Sequential Features
Event interpreted as string from some alphabet A
Structural Features
Event x is object composed substructures
Anomaly Detection for intrusion detection
Identification of attacks as deviations from normality
Center of Mass
Anomaly score given by distance from center
One-class SVM
Hypersphere enclosing data with minimum volume
Regularization by softening of the hypersphere
Support for learning and training using kernels only
Center of Neighbourhood
Anomaly score given by distance from local center
