Misfeasors Classification and Detection Models Using Machine Learning Techniques/ Nesrine Sameh Said

Supervisor: Neamat El-Gayyar

Thesis (M.A.)—Nile University, Egypt, 2010 .

"Includes bibliographical references"

Contents:CONTENT PAGE

Acknowledgments i
List of Tables iv
List of Figures vi
List of Abbreviations vii
Abstract viii

CHAPTER 1: INTRODUCTION 1
1.1 BACKGROUND 3
1.2 MOTIVATION 7
1.3 PROBLEM FORMULATION 9
1.4 OBJECTIVES AND CONTRIBUTIONS 10
1.5 THESIS OUTLINE 11
CHAPTER 2: MISFEASORS AND MACHINE LEARNING: STATE OF THE ART 12
2.1 MISFEASORS 12
2.2 MISFEASORS AND MACHINE LEARNING 14
2.3 IP SPOOFING DETECTION 16
2.3.1 Arpwatch 16
2.3.3 ARPDefender 18
2.3.4 XArp 18
2.3.5 ArpON 2.0 20
2.3.6 Cisco ASA 5500 Firewall 20
2.3.7 Sygate Personal Firewall 5.0 21
2.3.8 NetScreen 21
CHAPTER 3: MISFEASORS 23
3.1. TYPES 23
3.2. MOTIVES 25
3.3. FEATURES AND ATTACKS 27
3.4. DEFENSIVE MEASURES AGAINST MISFEASORS 31
CHAPTER 4: MACHINE LEARNING 33
4.1. DEFINITION 33
4.2. ADVANTAGES 35
4.3. CLASSIFIERS 37
4.3.1. Naive Bayes Classifier 37
4.3.2. Decision Trees Classifiers 38
4.4. PERFORMANCE MEASURES 40
CHAPTER 5: PROPOSED CLASSIFICATION MODELS 42
5.1. ENHANCING FEATURES USING THE MAC ADDRESS 42
5.2. PROPOSED CLASSIFICATION MODELS 50
5.2.1. The Rule Based Model (Model A) 50
5.2.2. The Hierarchical Classification Model (Model B) 52
5.2.3. The Composite Feature Model (Model C) 54
5.3. EVALUATING CLASSIFIERS PERFORMANCE 55
CHAPTER 6: DATA, EXPERIMENTS AND RESULTS 59
6.1. DATA 59
6.1.1. DARPA1998 Dataset 59
6.1.2. DARPA1999 Dataset 61
6.2. EXPERIMENTS 64
6.2.1. Evaluation Measures 64
6.2.2. Training Data 65
6.3. Results 81
CHAPTER 7: SUMMARY AND FUTURE WORK 89
REFERENCES 92

Abstract:
Misfeasors (or insiders) are considered among the most difficult intruders to detect due to their knowledge and authorization within the organization. Machine learning techniques have been widely used for intrusion detection but only little work has addressed the use of machine learning for detecting and classifying different types of insiders. The aim of this study is to exploit different recognition models for misfeasors detection by adding the Mac address as a feature in classification. Three different recognition models (a Rule Based Model, a Hierarchical Classification Model and a Composite Feature Model) are proposed. The models differ mainly in the amount of prior knowledge required for the problem and hence how training data is used to construct the models. The Rule Based Model uses explicit domain classification rules given by expert to detect insiders. The Hierarchical Classification Model uses some domain specific knowledge to manufacture the training data in order to construct the hierarchy in the recognition model. The Composite Feature Model on the other hand attempts to discover classification rules directly from the training data without any prior knowledge. All three proposed classification models are tested on two benchmark data sets and are evaluated using different performance measures. Results for the different models are presented and compared for several classification techniques. Experiments reveal that using machine learning at different levels in the proposed models yields a good approximation for the classification rules for the problem of misfeasor detection.

Text in English, abstracts in English.