Tags

Type your tag names separated by a space and hit enter

Maintaining defender's reputation in anomaly detection against insider attacks.
IEEE Trans Syst Man Cybern B Cybern. 2010 Jun; 40(3):597-611.IT

Abstract

We address issues related to establishing a defender's reputation in anomaly detection against two types of attackers: 1) smart insiders, who learn from historic attacks and adapt their strategies to avoid detection/punishment, and 2) naïve attackers, who blindly launch their attacks without knowledge of the history. In this paper, we propose two novel algorithms for reputation establishment--one for systems solely consisting of smart insiders and the other for systems in which both smart insiders and naïve attackers are present. The theoretical analysis and performance evaluation show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.

Authors+Show Affiliations

Department of Computer Science, George Washington University, Washington, DC 20052, USA. nzhang10@gwu.eduNo affiliation info availableNo affiliation info availableNo affiliation info available

Pub Type(s)

Journal Article
Research Support, Non-U.S. Gov't
Research Support, U.S. Gov't, Non-P.H.S.

Language

eng

PubMed ID

19933017

Citation

Zhang, Nan, et al. "Maintaining Defender's Reputation in Anomaly Detection Against Insider Attacks." IEEE Transactions On Systems, Man, and Cybernetics. Part B, Cybernetics : a Publication of the IEEE Systems, Man, and Cybernetics Society, vol. 40, no. 3, 2010, pp. 597-611.
Zhang N, Yu W, Fu X, et al. Maintaining defender's reputation in anomaly detection against insider attacks. IEEE Trans Syst Man Cybern B Cybern. 2010;40(3):597-611.
Zhang, N., Yu, W., Fu, X., & Das, S. K. (2010). Maintaining defender's reputation in anomaly detection against insider attacks. IEEE Transactions On Systems, Man, and Cybernetics. Part B, Cybernetics : a Publication of the IEEE Systems, Man, and Cybernetics Society, 40(3), 597-611. https://doi.org/10.1109/TSMCB.2009.2033564
Zhang N, et al. Maintaining Defender's Reputation in Anomaly Detection Against Insider Attacks. IEEE Trans Syst Man Cybern B Cybern. 2010;40(3):597-611. PubMed PMID: 19933017.
* Article titles in AMA citation format should be in sentence-case
TY - JOUR T1 - Maintaining defender's reputation in anomaly detection against insider attacks. AU - Zhang,Nan, AU - Yu,Wei, AU - Fu,Xinwen, AU - Das,Sajal K, Y1 - 2009/11/24/ PY - 2009/11/26/entrez PY - 2009/11/26/pubmed PY - 2010/12/25/medline SP - 597 EP - 611 JF - IEEE transactions on systems, man, and cybernetics. Part B, Cybernetics : a publication of the IEEE Systems, Man, and Cybernetics Society JO - IEEE Trans Syst Man Cybern B Cybern VL - 40 IS - 3 N2 - We address issues related to establishing a defender's reputation in anomaly detection against two types of attackers: 1) smart insiders, who learn from historic attacks and adapt their strategies to avoid detection/punishment, and 2) naïve attackers, who blindly launch their attacks without knowledge of the history. In this paper, we propose two novel algorithms for reputation establishment--one for systems solely consisting of smart insiders and the other for systems in which both smart insiders and naïve attackers are present. The theoretical analysis and performance evaluation show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives. SN - 1941-0492 UR - https://www.unboundmedicine.com/medline/citation/19933017/Maintaining_defender's_reputation_in_anomaly_detection_against_insider_attacks_ L2 - https://dx.doi.org/10.1109/TSMCB.2009.2033564 DB - PRIME DP - Unbound Medicine ER -