Advanced Persistent Threats (APTs) are difficult to detect due to their" low-and-slow" attack
patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based …

Today's architectures for intrusion detection force the IDS designer to make a difficult choice.
If the IDS resides on the host, it has an excellent view of what is happening in that host's …

We examine several host-based anomaly detection systems and study their security against
evasion attacks. First, we introduce the notion of a mimicry attack, which allows a …

Malware is a worldwide epidemic. Studies suggest that the impact of malware is getting
worse. Malware detectors are the primary tools in defense against malware. The quality of …

Anomaly detection is an essential component of protection mechanisms against novel
attacks. We propose to use several information-theoretic measures, namely, entropy …

Traditional intrusion detection systems (IDSs) focus on low-level attacks or anomalies, and
raise alerts independently, though there may be logical connections between them. In …

The call stack of a program execution can be a very good information source for intrusion
detection. There is no prior work on dynamically extracting information from the call stack …

This study is a survey and classification of the state-of-the-art in behavioural biometrics
which is based on skills, style, preference, knowledge, motor-skills or strategy used by …

We present an approach to user re-authentication based on the data collected from the
computer's mouse device. Our underlying hypothesis is that one can successfully model …

This chapter provides the overview of the state of the art in intrusion detection research.
Intrusion detection systems are software and/or hardware components that monitor …