Machine Learning and Data Mining for Computer Security: Methods and Applications [Paperback]

Machine Learning and Data Mining for Computer Security provides an overview of the current state of research in machine learning and data mining as it applies to problems in computer security. This book has a strong focus on information processing and combines and extends results from computer security.

The first part of the book surveys the data sources, the learning and mining methods, evaluation methodologies, and past work relevant for computer security. The second part of the book consists of articles written by the top researchers working in this area. These articles deals with topics of host-based intrusion detection through the analysis of audit trails, of command sequences and of system calls as well as network intrusion detection through the analysis of TCP packets and the detection of malicious executables.

This book fills the great need for a book that collects and frames work on developing and applying methods from machine learning and data mining to problems in computer security.

Survey Contributions.- An Introduction to Information Assurance.- Some Basic Concept of Machine Learning and Data Mining.- Research Contributions.- Learning to Detect Malicious Executables.- Data Mining Applied to Intrusion Detection: MITRE Experiences.- Intrusion Detection Alarm Clustering.- Behavioral Features for Network Anomaly Detection.- Cost-Sensitive Modeling for Intrusion Detection.- Data Cleaning and Enriched Representations for Anomaly Detection in System Calls.- A Decision-Theoritic, Semi-Supervised Model for Intrusion Detection.

Intrusion detection and analysis has received a lot of criticism and publicity over the last several years. The Gartner report took a shot saying Intrusion Detection Systems are dead, while others believe Intrusion Detection is just reaching its maturity. The problem that few want to admit is that the current public methods of intrusion dl"