000			04072nam a22002537a 4500
008			211216b2010 |||a|||f mb|| 00| 0 eng d
040			_aEG-CaNU _cEG-CaNU
041	0		_aeng _beng
082			_a658
100	0		_aNesrine Sameh Said _9898
245	1		_aMisfeasors Classification and Detection Models Using Machine Learning Techniques/ _cNesrine Sameh Said
260			_c2010
300			_a94 p. _bill. _c21 cm.
500			_3Supervisor: Neamat El-Gayyar
502			_aThesis (M.A.)—Nile University, Egypt, 2010 .
504			_a"Includes bibliographical references"
505	0		_aContents:CONTENT PAGE Acknowledgments i List of Tables iv List of Figures vi List of Abbreviations vii Abstract viii CHAPTER 1: INTRODUCTION 1 1.1 BACKGROUND 3 1.2 MOTIVATION 7 1.3 PROBLEM FORMULATION 9 1.4 OBJECTIVES AND CONTRIBUTIONS 10 1.5 THESIS OUTLINE 11 CHAPTER 2: MISFEASORS AND MACHINE LEARNING: STATE OF THE ART 12 2.1 MISFEASORS 12 2.2 MISFEASORS AND MACHINE LEARNING 14 2.3 IP SPOOFING DETECTION 16 2.3.1 Arpwatch 16 2.3.3 ARPDefender 18 2.3.4 XArp 18 2.3.5 ArpON 2.0 20 2.3.6 Cisco ASA 5500 Firewall 20 2.3.7 Sygate Personal Firewall 5.0 21 2.3.8 NetScreen 21 CHAPTER 3: MISFEASORS 23 3.1. TYPES 23 3.2. MOTIVES 25 3.3. FEATURES AND ATTACKS 27 3.4. DEFENSIVE MEASURES AGAINST MISFEASORS 31 CHAPTER 4: MACHINE LEARNING 33 4.1. DEFINITION 33 4.2. ADVANTAGES 35 4.3. CLASSIFIERS 37 4.3.1. Naive Bayes Classifier 37 4.3.2. Decision Trees Classifiers 38 4.4. PERFORMANCE MEASURES 40 CHAPTER 5: PROPOSED CLASSIFICATION MODELS 42 5.1. ENHANCING FEATURES USING THE MAC ADDRESS 42 5.2. PROPOSED CLASSIFICATION MODELS 50 5.2.1. The Rule Based Model (Model A) 50 5.2.2. The Hierarchical Classification Model (Model B) 52 5.2.3. The Composite Feature Model (Model C) 54 5.3. EVALUATING CLASSIFIERS PERFORMANCE 55 CHAPTER 6: DATA, EXPERIMENTS AND RESULTS 59 6.1. DATA 59 6.1.1. DARPA1998 Dataset 59 6.1.2. DARPA1999 Dataset 61 6.2. EXPERIMENTS 64 6.2.1. Evaluation Measures 64 6.2.2. Training Data 65 6.3. Results 81 CHAPTER 7: SUMMARY AND FUTURE WORK 89 REFERENCES 92
520	3		_aAbstract: Misfeasors (or insiders) are considered among the most difficult intruders to detect due to their knowledge and authorization within the organization. Machine learning techniques have been widely used for intrusion detection but only little work has addressed the use of machine learning for detecting and classifying different types of insiders. The aim of this study is to exploit different recognition models for misfeasors detection by adding the Mac address as a feature in classification. Three different recognition models (a Rule Based Model, a Hierarchical Classification Model and a Composite Feature Model) are proposed. The models differ mainly in the amount of prior knowledge required for the problem and hence how training data is used to construct the models. The Rule Based Model uses explicit domain classification rules given by expert to detect insiders. The Hierarchical Classification Model uses some domain specific knowledge to manufacture the training data in order to construct the hierarchy in the recognition model. The Composite Feature Model on the other hand attempts to discover classification rules directly from the training data without any prior knowledge. All three proposed classification models are tested on two benchmark data sets and are evaluated using different performance measures. Results for the different models are presented and compared for several classification techniques. Experiments reveal that using machine learning at different levels in the proposed models yields a good approximation for the classification rules for the problem of misfeasor detection.
546			_aText in English, abstracts in English.
650		4	_aInformation Security _9294
655		7	_2NULIB _aDissertation, Academic _9187
690			_aInformation Security _9294
942			_2ddc _cTH
999			_c9186 _d9186