Find us on

Upcoming Events

	My Computer Ate My Data, Changed My Students' Grades and Stole My Money OR What all faculty need to know about securing their information Friday May 18, 2012 at 12:30-2pm DCAL Conference Room, 102 Baker Library
	Mobile Measurement of Behavioral and Social Health at Population Scale Santosh Kumar University of Memphis Wednesday May 23 at 4:15pm Steele 006

Past Programs

	Cyber War, Cyber Peace, Stones, and Glass Houses Gary McGraw Cigital, Inc. April 26, 2012
	Real-Time Crowd Support for People with Disabilities Jeff Bigham University of Rochester November 15, 2011
	Cyber Operations and National Security A Panel Discussion October 20, 2011
	CISO vs. Adversary Healthcare Security Investment Game July 7, 2011

Institute for Security, Technology, and Society
Dartmouth College
6211 Sudikoff Laboratory
Hanover, NH 03755 USA
info.ists@dartmouth.edu

Data Mining for Detection of Network Intrusions

Data Mining for Intrusion Detection

Stepping Stones: We have focused on the application of data-mining techniques to a particular problem: detecting "stepping stones,'' that is, a situation where someone is telnetting through a sequence of machines. The theory is that while some of these occurrences are innocent, hackers quite frequently use a series of steppingstones to get to their target, in order to minimize the chance that the intrusion can be traced to their home machine.
Masqueraders: Using the recently published Bell-Labs benchmark data, where real users' logs of UNIX commands were modified by using real logs from another user in a small number of places, Mr. Yung investigated the problem of detecting "masqueraders," where one user gets control of the account of another. Yung developed a technique that beats all of the proposed techniques that have been developed for the problem represented by this data. In particular, he gets significantly smaller false-positive rates for a fixed false-negative rate. The big idea is constant revision of what "normal" behavior for a user means, as more data is gathered, and the user's behavior evolves slowly.