- 期刊
Detecting Connection-Chains: A Data Mining Approach
並列摘要
A connection-chain refers to a mechanism in which some- one recursively logs into a host, then from there logs into another host, and so on. Connection-chains represent an important vector in many security attacks, so it is essential to be able to detect them. In this paper, we pro- pose a host-based algorithm to detect them. We adopt a black-box approach by passively monitoring inbound and outbound packets at a host, and analyzing the observed packets using association rule mining. We first explain the proposed algorithm in greater details, then evaluations are presented to demonstrate its efficiency and detection capabilities. We conduct the evaluation using public network traces, and show that by appropriately setting underlying parameters we can achieve perfect detection, meaning a true positive rate (TPR) of 100% and a false positive rate (FPR) of 0%.
被引用紀錄
延伸閱讀
- 邱鼎穎 (2008). On Frequent Sequence Mining and online Classification Techniques [doctoral dissertation, National Tsing Hua University]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0016-0903200911353515
- 劉羿杏（2006）。Application of Data Mining Techniques on Network Bidding Behavior〔碩士論文，淡江大學〕。華藝線上圖書館。https://doi.org/10.6846/TKU.2006.00626
- Chiang, W. Y. (2019). Fraudulent Financial Statement Detection Using Data Mining Techniques [master's thesis, National Taiwan University]. Airiti Library. https://doi.org/10.6342/NTU201903029
- 蔡美君（2012）。A Real-Time Anti-Data Mining Technique for Dynamic Databases〔碩士論文，國立臺中科技大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0061-2307201201414200
- Paz, K. E. O. (2008). Fraud Detection for Internet Auctions: A Data Mining Approach [master's thesis, National Tsing Hua University]. Airiti Library. https://doi.org/10.6843/NTHU.2008.00578