MLSEC 6

Question 1

Classification for intrusion detection

Answer 1

Discrimination between benign events and attacks

Question 2

Sources for attack data

Answer 2

Honeypot systems

Forensic analysis

Security Community

Question 3

Classification using a perceptron rule

Answer 3

Learning by iterative updates of weight vector w

• Pick xi from training data and compute f(xi)
• If xi correctly classified ➝ do nothing
• If xi incorrectly classified ➝ w = w + y(xi)

Question 4

Two-class SVM

Answer 4

Hyperplane separating data with maximum margin

Regularization by softening of the hyperplane

Support for learning and training using kernels only

Question 5

margin SVM

Answer 5

m = 2 / ||w||

Question 6

Poisoning of learning

Answer 6

Careful injection of malicious or benign data

Question 7

Mimicry during detection

Answer 7

Adaption of attacks to mimic normal activity

Question 8

Red herring during detection

Answer 8

Denial-of-service with bogus malicious activity

Question 9

Drebin

Answer 9

detect and protect against malicious software (malware) on Android devices

Question 10

Zoe

Answer 10

Protection in Industrial Control Systems

Stateful Anomaly Detection

Protocol-Agnostic Analysis