Search

In this paper, we present the performance of machine learning-based methods for detection of phishing sites. We employ 9 machine learning techniques including AdaBoost, Bagging, Support Vector Machines, Classification and Regression Trees, Logistic Regression, Random Forests, Neural Networks, Naive Bayes, and Bayesian Additive Regression Trees. We let these machine learning techniques combine heuristics, and also let machine learning-based detection methods distinguish phishing sites from others. We analyze our dataset, which is composed of 1,500 phishing sites and 1,500 legitimate sites, classify them using the machine learning-based detection methods, and measure the performance. In our evaluation, we used f1 measure, error rate, and Area Under the ROC Curve (AUC) as performance metrics along with our requirements for detection methods. The highest f1 measure is 0.8581, the lowest error rate is 14.15%, and the highest AUC is 0.9342, all of which are observed in the case of AdaBoost. We also observe that 7 out of 9 machine learning-based detection methods outperform the traditional detection method. [ABSTRACT FROM AUTHOR]

Personalized Transductive Learning (PTL) builds a unique local model for classification of each test sample and therefore is practically neighborhood dependant. While existing PTL methods usually define the neighborhood by a predefined (dis)similarity measure, in this paper we introduce a new concept of knowledgeable neighborhood and a transductive SVM classification tree (t-SVMT) for PTL. The neighborhood of a test sample is constructed over the classification knowledge modelled by regional SVMs, and a set of such SVMs adjacent to the test sample are aggregated systematically into a t-SVMT. Compared to a regular SVM and other SVMTs, the proposed t-SVMT, by virtue of the aggregation of SVMs, has an inherent superiority on classifying class-imbalanced datasets. Furthermore, t-SVMT has solved the over-fitting problem of all previous SVMTs as it aggregates neighborhood knowledge and thus significantly reduces the size of the SVM tree. [ABSTRACT FROM AUTHOR]

Botnet has gained the most prevalence in today΄s cyber-attacks, resulting in significant threats to our network assets and organization΄s property. A botnet is composed of a group of bots and controlled by a botmaster, serving as a powerful tool to enforce various attacks, e.g., launching massive attacks like spamming and DDoS, stealing sensitive information. While a bunch of anti-bot techniques have been proposed, the evolution trend of botnets show that sophisticated botmasters can always manage to evade the botnet countermeasures. From the standpoint of potential attackers, and by examining the vulnerabilities of the existing botnets, this paper aims at exploring the means for hardening botnets, especially the obfuscation of communication channels between bot and botmaster. In particular, a stronger botnet variant named bot-enclave, is proposed to illustrate how the robustness of C&C (command-and-control) servers can be enhanced, and how the botnet communications can be protected from being tracked and intercepted. More practically, by identifying the trade off between botnet utility metrics, we show that the sophistication level of bot-enclave can be tuned up by a rational botmaster in order to construct more economical, feasible and effective botnet variants. The findings may significantly help us to gain insight into the characteristics of next-generation botnets, to be aware of the evolution trend before their actual occurrence, and ultimately to suggest the development of proactive anti-botnet techniques. [ABSTRACT FROM AUTHOR]

For labelling network intrusions as they state hierarchical multi-label structure, we develop a hierarchical core vector machines (HCVM) algorithm for high-speed network intrusion detection via hierarchical multi-label classification of network data. HCVM models a multi-label hierarchy into a data Hyper-Sphere constructed by numbers of core vector machines (CVM). As the CVMs in an HCVM are separating, encompassing and overlapping with each other, which forms naturally a tree structure representing the multi-label hierarchy encoded. Provided an unlabelled sample, the HCVM seeks a CVM enclosing the sample, and multiply label the sample according to the MEB΄s position in the hierarchy. The proposed HCVM method has been examined on KDD΄99 and the result shows that the proposed HCVM has significant improvement over previously published benchmark works. HCVM improves U2R accuracy from 13.2% to 82.7% and R2L from 8.4% to 45.9%, as compared to the winner of KDD΄99. In particular, the efficiency of HCVM is highlighted, as the computational time stays steady while the size of training data exponentially manifolds. [ABSTRACT FROM AUTHOR]

For network intrusion and virus detection, ordinary methods detect malicious network traffic and viruses by examining packets, flow logs or content of memory for any signatures of the attack. This implies that if no signature is known/created in advance, attack detection will be problematical. Addressing unknown attacks detection, we develop in this paper a network traffic and spam analyzer using a string kernel based SVM (support vector machine) supervised machine learning. The proposed method is capable of detecting network attack without known/earlier determined attack signatures, as SVM automatically learning attack signatures from traffic data. For application to internet security, we have implemented the proposed method for spam email detection over the SpamAssasin and E. M. Canada datasets, and network application authentication via real connection data analysis. The obtained above 99% accuracies have demonstrated the usefulness of string kernel SVMs on network security for either detecting `abnormal΄ or protecting `normal΄ traffic. [ABSTRACT FROM AUTHOR]

In this paper, we present an approach that aims to study users΄ past trust decisions (PTDs) for improving the accuracy of detecting phishing sites. Generally, Web users required to make trust decisions whenever their personal information is asked for by websites. We assume that the database of users΄ PTDs would be transformed into a binary vector, representing phishing or not, and the binary vector can be used for detecting phishing sites similar to the existing heuristics. For our pilot study, we invited 10 participants and performed a subject experiment in November 2007. The participants browsed 14 emulated phishing sites and 6 legitimate sites, and checked whether the site appeared to be a phishing site or not. By utilizing participants΄ trust decision as a new heuristic, we let AdaBoost incorporate the heuristic into 8 existing heuristics. The results show that the average error rate in the case of HumanBoost is 9.5%, whereas that in the case of participants is 19.0% and that in the case of AdaBoost is 20.0%. Thus, we conclude that HumanBoost has a potential to improve the detection accuracy for each Web user. [ABSTRACT FROM AUTHOR]

The Distance Index (D-index) is a recently introduced metric indexing structure which has state-of-the-art performance in large scale metric search applications. Inspired by D-index, we introduce a novel index structure, termed AdaIndex, for fast similarity search in generic metric spaces. With multiple principles from other advanced algorithms, AdaIndex shows a significant improvement in reduction of distance calculations compared with D-index. To treat with application with different system limitations and diverse nature of data, we introduce a parameter tuning algorithm to build an optimal AdaIndex structure with minimal overall computational costs. The efficiency of AdaIndex is validated on a series of simulation experiments. [ABSTRACT FROM AUTHOR]

Besides the classic measurement methodologies such asping for measuring RTT and traceroute for discovering IP topology, there also exists a new trend in measurement methodology, cooperative measurement [1,2]. In cooperative measurement, a measurement node sometimes communicates with other measurement nodes, shares collected data, and estimates the network characteristics of some parts of network elements without actual measurement. Cooperative measurement is considered appropriate especially for large-scale measurement on overlay networks because network characteristics can be helpful for increasing the autonomy of overlay networks and such measurement methodologies have a potential for the reasonable estimation of network characteristics against a number of elements within the limited measurement capacity of each node. [ABSTRACT FROM AUTHOR]

The importance of large-scale measurement infrastructures for grasping the global state of the Internet is recently strongly emphasized. However, a fundamental analysis of these infrastructures has not yet been conducted. In this paper, we highlight the formation of measurement networks and provide a first look at measurement activities performed on those networks. We also propose a scheme for constructing a measurement network, which divides the measurement agent's roles into core agent and stub agent. This scheme entails only simple adjustment for changing the formation of the measurement network. Through the transition from a centralized system to hybrid and pure peer-to-peer networks, we visualize the flow of measurement procedures and explore the factors that have an influence on the overall performance of measurement systems. [ABSTRACT FROM AUTHOR]

VMM (virtual machine monitor) provides the useful inspection and interposition of the guest OS. With proper modification of the guest OS and VMM, we can obtain incident-driven memory snapshot for malicious code forensics. In this paper we propose an asynchronous memory snapshot and forensics using split kernel module. Our split kernel module works for the virtualized interruption handling, which notifies the security incident on the guest OS. On frontend, we insert virtualized interruption into source code of MAC (mandatory access control) module and other security modules. Then, backend kernel module receives interruption as the asynchronous incident notification. In experiment, we take RAM snapshot of LKM-rootkit installation using system call extension. Frequently appeared strings are extracted in order to find the evidence memory blocks which was assigned for LKM-rootkit. Also, it is showed that asynchronous snapshot enables us to find the evidence of malicious software in memory snapshot by simple string analysis in linear time. [ABSTRACT FROM AUTHOR]

In this paper, we explain that by only applying a simple filtering algorithm into various proxy systems, almost all phishing attacks can be blocked without loss of convenience to the user. We propose a system based on a simple filtering algorithm which we call the Sanitizing Proxy System (SPS). The key idea of SPS is that Web phishing attack can be immunized by removing part of the content that traps novice users into entering their personal information. Also, since SPS sanitizes all HTTP responses from suspicious URLs with warning messages, novice users will realize that they are browsing phishing sites. The SPS filtering algorithm is very simple and can be described in roughly 20 steps, and can also be built in any proxy system, such as a server solution, a personal firewall or a browser plug-in. By using SPS with a transparent proxy server, novice users will be protected from almost all Web phishing attacks even if novice users misbehave. With a deployment model, robustness and evaluation, we discuss the feasibility of SPS in today's network operations. [ABSTRACT FROM AUTHOR]