Entry Lane:1999:TSL from tissec.bib

Last update: Sun Oct 15 02:58:48 MDT 2017                Valid HTML 3.2!

Index sections

Top | Symbols | Numbers | Math | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

BibTeX entry

@Article{Lane:1999:TSL,
  author =       "Terran Lane and Carla E. Brodley",
  title =        "Temporal sequence learning and data reduction for
                 anomaly detection",
  journal =      j-TISSEC,
  volume =       "2",
  number =       "3",
  pages =        "295--331",
  month =        aug,
  year =         "1999",
  CODEN =        "ATISBQ",
  ISSN =         "1094-9224 (print), 1557-7406 (electronic)",
  ISSN-L =       "1094-9224",
  bibdate =      "Thu Oct 26 11:39:38 MDT 2000",
  bibsource =    "http://www.acm.org/tissec/contents/v2no3.html;
                 http://www.math.utah.edu/pub/tex/bib/tissec.bib",
  URL =          "http://www.acm.org/pubs/citations/journals/tissec/1999-2-3/p295-lane/",
  abstract =     "The anomaly-detection problem can be formulated as one
                 of learning to characterize the behaviors of an
                 individual, system, or network in terms of temporal
                 sequences of discrete data. We present an approach on
                 the basis of instance-based learning (IBL) techniques.
                 To cast the anomaly-detection task in an IBL framework,
                 we employ an approach that transforms temporal
                 sequences of discrete, unordered observations into a
                 metric space via a similarity measure that encodes
                 intra-attribute dependencies. Classification boundaries
                 are selected from an {\em a posteriori\/}
                 characterization of valid user behaviors, coupled with
                 a domain heuristic. An empirical evaluation of the
                 approach on user command data demonstrates that we can
                 accurately differentiate the profiled user from
                 alternative users when the available features encode
                 sufficient information. Furthermore, we demonstrate
                 that the system detects anomalous conditions {\em
                 quickly\/} --- an important quality for reducing
                 potential damage by a malicious user. We present
                 several techniques for reducing data storage
                 requirements of the user profile, including
                 instance-selection methods and clustering. As empirical
                 evaluation shows that a new greedy clustering algorithm
                 reduces the size of the user model by 70\%, with only a
                 small loss in accuracy.",
  acknowledgement = ack-nhfb,
  fjournal =     "ACM Transactions on Information and System Security",
  journal-URL =  "http://portal.acm.org/browse_dl.cfm?idx=J789",
  keywords =     "anomaly detection; clustering; data reduction;
                 empirical evaluation; instance based learning; machine
                 learning; user profiling",
  subject =      "Software --- Operating Systems --- Security and
                 Protection (D.4.6)",
}

Related entries