Security Tools White Papers
An Adaptive Anomaly Detector for Worm Detection
Overview This paper presents an adaptive end-host anomaly detector where a supervised classifier trained as a traffic predictor is used to control a time-varying detection threshold. Training and testing it on real traffic traces collected from a number of end-hosts, it shows the detector dominates an existing fixed threshold detector. This comparison is robust to the choice of off-the-shelf classifier employed, and to a variety of performance criteria: the predictor's error rate, the reduction in the "Threshold gap" and the ability to detect the simulated threat of incremental worm traffic added to the traces. This detector is intended as a part of a distributed worm detection system that infers system-wide threats from end-host detections, thereby avoiding the sensing and resource limitations of conventional centralized systems.
| Publisher | Rutgers, State University of New Jersey | File Format | |
|---|---|---|---|
| Date Published | November 2006 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 4 out of 5 users found this white paper useful
White Paper RSS
Download
Register
