%0 Book Section %1 Ring2017 %A Ring, Markus %A Wunderlich, Sarah %A Grüdl, Dominik %A Landes, Dieter %A Hotho, Andreas %B Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications %C Cham %D 2017 %E Palomares Carrascosa, Iván %E Kalutarage, Harsha Kumara %E Huang, Yan %I Springer International Publishing %K %P 3--31 %R 10.1007/978-3-319-59439-2_1 %T A Toolset for Intrusion and Insider Threat Detection %U https://doi.org/10.1007/978-3-319-59439-2_1 %X Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives. %@ 978-3-319-59439-2

@inbook{Ring2017, abstract = {Company data are a valuable asset and must be protected against unauthorized access and manipulation. In this contribution, we report on our ongoing work that aims to support IT security experts with identifying novel or obfuscated attacks in company networks, irrespective of their origin inside or outside the company network. A new toolset for anomaly based network intrusion detection is proposed. This toolset uses flow-based data which can be easily retrieved by central network components. We study the challenges of analysing flow-based data streams using data mining algorithms and build an appropriate approach step by step. In contrast to previous work, we collect flow-based data for each host over a certain time window, include the knowledge of domain experts and analyse the data from three different views. We argue that incorporating expert knowledge and previous flows allow us to create more meaningful attributes for subsequent analysis methods. This way, we try to detect novel attacks while simultaneously limiting the number of false positives.}, added-at = {2023-12-13T02:08:39.000+0100}, address = {Cham}, author = {Ring, Markus and Wunderlich, Sarah and Gr{\"u}dl, Dominik and Landes, Dieter and Hotho, Andreas}, biburl = {https://www.bibsonomy.org/bibtex/287a19e38f7d15abf2e9588b99c3a40f9/admin}, booktitle = {Data Analytics and Decision Support for Cybersecurity: Trends, Methodologies and Applications}, doi = {10.1007/978-3-319-59439-2_1}, editor = {Palomares Carrascosa, Iv{\'a}n and Kalutarage, Harsha Kumara and Huang, Yan}, interhash = {7b78d97826bab6f2dcd42e5d41f48ffa}, intrahash = {87a19e38f7d15abf2e9588b99c3a40f9}, isbn = {978-3-319-59439-2}, keywords = {}, pages = {3--31}, publisher = {Springer International Publishing}, timestamp = {2023-12-13T02:08:39.000+0100}, title = {A Toolset for Intrusion and Insider Threat Detection}, type = {Publication}, url = {https://doi.org/10.1007/978-3-319-59439-2_1}, year = 2017 }