Learning Rules for Anomaly Detection of Hostile Network恶意网络异常检测的学习规则.pptVIP

Learning Rules for Anomaly Detection of Hostile Network Traffic Matthew V. Mahoney and Philip K. Chan Florida Institute of Technology Problem: How to detect novel intrusions in network traffic given only a model of normal traffic Normal web server request GET /index.html HTTP/1.0 Code Red II worm GET /default.ida?NNNNNNNNN… What has been done Firewalls Can’t block attacks on open ports (web, mail, DNS) Signature Detection (SNORT, BRO) Hand coded rules (search for “default.ida?NNN”) Can’t detect new attacks Anomaly Detection (eBayes, ADAM, SPADE) Learn rules from normal traffic for low