We present a new Host-based Intrusion Detection System (IDS) that monitors accesses to the Microsoft Windows Registry using Registry Anomaly Detection (RAD). Our system uses a one class Support Vector Machine (OCSVM) to detect anomalous registry behavior by training on a dataset of normal registry accesses. It then uses this model to detect outliers in new (unclassified) data generated from the...

intrusion detection in wireless networks has been a challenging researchproblem in network security for more than half a century. this paper presents anovel intrusion detection method based on received signal strength acceptancetest (rssat) to improve the ids capabilities in anomaly-based host-basedintrusion detection systems (hids). the new system can identify suspiciousbehaviors detecting ano...

Generative adversarial networks (GANs) are able to model the complex highdimensional distributions of real-world data, which suggests they could be effective for anomaly detection. However, few works have explored the use of GANs for the anomaly detection task. We leverage recently developed GAN models for anomaly detection, and achieve state-of-the-art performance on image and network intrusio...

Anomaly detection is a key element of intrusiondetection and other detection systems in which perturbations of normal behavior suggest the presence of intentionally or unintentionally induced attacks, faults, defects, etc. Because most anomaly detectors are based on probabilistic algorithms that exploit the intrinsic structure, or regularity, embedded in data logs, a fundamental question is whe...

Today networks suffer from various challenges like distributed denial of service attacks or worms. Multiple different anomaly-based detection systems try to detect and counter such challenges. Anomaly-based systems, however, often show high false negative rates. One reason for this is that detection systems work as single instances that base their decisions on local knowledge only. In this pape...

RX Detector is recognized as the benchmark algorithm for image anomaly detection, however it presents known limitations, namely the dependence over the image following a multivariate Gaussian model, the estimation and inversion of a highly dimensional covariance matrix and the inability to effectively include spatial awareness in its evaluation. In this work a novel graph-based solution to the ...

It is generally agreed that two key points always attract special concerns during the modelling of anomaly-based intrusion detection. One is the techniques about discerning two classes with different features, another is the construction/selection of the observed sample of normally occurring patterns for system normality characterization. In this paper, instead of focusing on the design of spec...

Anomaly-based intrusion detection is about discerning intrusive and normal patterns of activities based on the normality characterization of information systems. The common goal of anomaly-based intrusion detection is to detect intrusive attacks as many as possible with fewer false alerts. Generally, our work is to study effective models, methods and techniques for anomaly-based intrusion detec...

Intrusions detection systems (IDSs) are systems that try to detect attacks as they occur or after the attacks took place. IDSs collect network traffic information from some point on the network or computer system and then use this information to secure the network. Intrusion detection systems can be misuse-detection or anomaly detection based. Misuse-detection based IDSs can only detect known a...