Read the summary and the most important questions on CS4035

• Week 1

  This is a preview. There are 3 more flashcards available for chapter 11/06/2017
  Show more cards here

• What is the traditional technique to prevent/capture botnets?

  1. Code analysis and finding malware fingerprints

• Why does classic ML fail in cyber security?

  - Large majority (> 99%) of cases are benign!
         • adapt data/models, otherwise no positives
  - Data is massive and keeps coming in!
         • need to count quickly, reduce false positives
  - There is an opponent, they learn too!
         • avoid using generic fingerprints/simple rules

• What can you do against the massive amounts of data?

  
  Simple solution:

  • count approximately with hash functions.

  
  
  More complex solution:

  • apply distributed data processing.

• What is a downside of N-grams?

  Size can blow-up. (Use hash!)

• What do you do in ML given the fact that an opponent learns to?

  Detect behavior instead of predefined patterns!

• Week 2

  This is a preview. There are 10 more flashcards available for chapter 12/06/2017
  Show more cards here

• What 4 point anomaly detection techniques were presented during the lecture?

  1. Classification Based
  2. Nearest Neighbor Based
  3. Clustering Based
  4. Statistical
  5. Others...

• What is the main idea of classification based anomaly detection?

  • Build a classification model for normal and anomalous (rare) events based on labelled training data, and use it to classify each new unseen event.

• What 2 categories does classification based techniques for anomaly detection consist of?

  • Supervised classification techniques
  • • Require knowledge of both normal and anomaly class
    • Build classifier to distinguish between normal and known anomalies
    • (You are doing this on your 1st lab assignment)

  • Semi-supervised classification techniques
    
  • • Require knowledge of normal class only!
    • Use modified classification model to learn the normal behavior and then detect any deviations from normal behavior as anomalous

• What are advantages of classification based techniques for anomaly detection?

  • Advantages:
  • • Supervised classification techniques
    • • Models that can be easily understood
      • High accuracy in detecting many kinds of known anomalies
    • Semi-supervised classification techniques
    • • Models that can be easily understood
      • Normal behavior can be accurately learned

• What are disadvantages of classification based techniques for anomaly detection?

  • Drawbacks:
  • • Supervised classification techniques
    • • Require both labels from both normal and anomaly class
      • Cannot detect unknown and emerging anomalies
    • Semi-supervised classification techniques
    • • Require labels from normal class
      • Possible high false alarm rate - previously unseen (yet legitimate) data records may be recognized as anomalies