Publication Details

String Kernel Based SVM for Internet Security Implementation

MICHLOVSKÝ Zbyněk. String Kernel Based SVM for Internet Security Implementation. In: Neural Information Processing. Lecture Notes in Computer Science. Berlin / Heidelberg: Springer Verlag, 2009, pp. 530-539. ISBN 978-3-642-10682-8.
Czech title
Aplikace SVM pro internetovou bezpečnost, založené na řetězcových jádrech
Type
conference paper
Language
english
Authors
Michlovský Zbyněk, Ing. (DITS FIT BUT)
Keywords

SVM, string kernel functions, internet security

Abstract

In this work, we develop SVM based string kernel method according to different mathematical similarity expressions of two strings/substrings. For network security, we derive string kernel SVM for automatical attack (i.e. spam emails) signature analysis, conducting spam filtering without early determined spam signature. Moreover, we have used string kernel SVM to authenticate legitimate network applications.

Annotation

For network intrusion and virus detection, ordinary methods detect malicious network traffic and viruses by examining packets, flow logs or content of memory for any signatures of the attack. This implies that if no signature is known/created in advance, attack detection will be problematical. Addressing unknown attacks detection, we develop in this paper a network traffic and spam analyzer using a string kernel based SVM (support vector machine) supervised machine learning. The proposed method is capable of detecting network attack without known/earlier determined attack signatures, as SVM automatically learning attack signatures from traffic data. For application to internet security, we have implemented the proposed method for spam email detection over the SpamAssasin and E. M. Canada datasets, and network application authentication via real connection data analysis. The obtained above 99% accuracies have demonstrated the usefulness of string kernel SVMs on network security for either detecting 'abnormal' or protecting 'normal' traffic.

Published
2009
Pages
530-539
Proceedings
Neural Information Processing
Series
Lecture Notes in Computer Science
Conference
ICONIP 2009 : 16th International Conference on Neural Information Processing , Bangkok, TH
ISBN
978-3-642-10682-8
Publisher
Springer Verlag
Place
Berlin / Heidelberg, DE
BibTeX
@INPROCEEDINGS{FITPUB9135,
   author = "Zbyn\v{e}k Michlovsk\'{y}",
   title = "String Kernel Based SVM for Internet Security Implementation",
   pages = "530--539",
   booktitle = "Neural Information Processing",
   series = "Lecture Notes in Computer Science",
   year = 2009,
   location = "Berlin / Heidelberg, DE",
   publisher = "Springer Verlag",
   ISBN = "978-3-642-10682-8",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/9135"
}
Back to top