Timeline for Anomaly-based Malware Detection in Web Applications
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 3, 2017 at 13:49 | comment | added | Andrey Sapegin | I haven't meant neural networks here. Besides neural networks, there are a lot of other machine learning and data mining techniques such as SVM (or one-class SVM for anomaly detection) that exactly have "a strict mathematical model, and flag any deviation from this as an attack". Classical neural networks are not a best choice for anomaly detection, in this area usually ocSVM or other methods are applied. However, there are anomaly detection techniques based on neural networks: Self-Organising Maps and Replicator Neural Networks. | |
| Mar 3, 2017 at 13:30 | comment | added | McJohnson | It's true that systems using artificial neural networks that are self-learning can produce quite good results but I am more inclined to define what normal usage of the system comprises using a strict mathematical model, and flag any deviation from this as an attack. By the way, the last paper you linked seems to contain a lot of useful information, thank you! | |
| Mar 3, 2017 at 13:30 | comment | added | McJohnson | Thank you for your answer. Yes, I am aware that there will be a lot of false positive results but I hope that during the testing phase I can reduce those and increasing the criteria might also contribute to that. And yes, I do plan on running ClamAV with its signatures first and once it's done and I have removed the malware detected by it, I will run an anomaly detection. | |
| Mar 3, 2017 at 10:43 | history | edited | Andrey Sapegin | CC BY-SA 3.0 |
added 188 characters in body
|
| Mar 3, 2017 at 10:36 | history | answered | Andrey Sapegin | CC BY-SA 3.0 |