var bibbase_data = {"data":"\"Loading..\"\n\n
\n\n \n\n \n\n \n \n\n \n\n \n \n\n \n\n \n
\n generated by\n \n \"bibbase.org\"\n\n \n
\n \n\n
\n\n \n\n\n
\n\n Excellent! Next you can\n create a new website with this list, or\n embed it in an existing web page by copying & pasting\n any of the following snippets.\n\n
\n JavaScript\n (easiest)\n
\n \n <script src=\"https://bibbase.org/show?bib=https%3A%2F%2Fweb.cs.dal.ca%2F%7Elcd%2Fpubs%2Flcd.bib&jsonp=1&jsonp=1\"></script>\n \n
\n\n PHP\n
\n \n <?php\n $contents = file_get_contents(\"https://bibbase.org/show?bib=https%3A%2F%2Fweb.cs.dal.ca%2F%7Elcd%2Fpubs%2Flcd.bib&jsonp=1\");\n print_r($contents);\n ?>\n \n
\n\n iFrame\n (not recommended)\n
\n \n <iframe src=\"https://bibbase.org/show?bib=https%3A%2F%2Fweb.cs.dal.ca%2F%7Elcd%2Fpubs%2Flcd.bib&jsonp=1\"></iframe>\n \n
\n\n

\n For more details see the documention.\n

\n
\n
\n\n
\n\n This is a preview! To use this list on your own web site\n or create a new web site from it,\n create a free account. The file will be added\n and you will be able to edit it in the File Manager.\n We will show you instructions once you've created your account.\n
\n\n
\n\n

To the site owner:

\n\n

Action required! Mendeley is changing its\n API. In order to keep using Mendeley with BibBase past April\n 14th, you need to:\n

    \n
  1. renew the authorization for BibBase on Mendeley, and
    2. \n
  2. update the BibBase URL\n in your page the same way you did when you initially set up\n this page.\n
    3. \n
\n

\n\n

\n \n \n Fix it now\n

\n
\n\n
\n\n\n
\n \n \n
\n
\n  \n 2021\n \n \n (2)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n \n Anomaly Detection for Insider Threats Using Unsupervised Ensembles.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, A. N.\n\n\n \n\n\n\n IEEE Transactions on Network and Service Management, 18(2): 1152–1164. June 2021.\n \n\n\n\n
\n\n\n\n \n \n \"AnomalyPaper\n  \n \n \n \"Anomaly paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 4 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@ARTICLE{Le_tnsm2021,\nauthor={Le, Duc C. and Zincir-Heywood, A. Nur},\njournal={IEEE Transactions on Network and Service Management},\ntitle={Anomaly Detection for Insider Threats Using Unsupervised Ensembles},\nabstract = {Insider threat represents a major cybersecurity challenge to companies, organizations, and government agencies. Insider threat detection involves many challenges, including unbalanced data, limited ground truth, and possible user behaviour changes. This research presents an unsupervised learning based anomaly detection approach for insider threat detection. We employ four unsupervised learning methods with different working principles, and explore various representations of data with temporal information. Furthermore, different computational intelligence schemes are explored to combine these models to create anomaly detection ensembles for improving the detection performance. Evaluation results show that the approach allows learning from unlabelled data under challenging conditions for insider threat detection. Insider threats are detected with high detection and low false positive rates. For example, 60\\% of malicious insiders are detected under 0.1\\% investigation budget, and all malicious insiders are detected at at less than 5\\% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting new anomalous behaviours in different datasets, i.e. robustness. Finally, results demonstrate that a voting-based ensemble of anomaly detection can be used to improve detection performance as well as the robustness. Comparisons with the state-of-the-art confirm the effectiveness of the proposed approach.},\nmonth=jun,\nyear={2021},\nvolume={18},\nnumber={2},\npages={1152--1164},\nkeywords={insider threat detection,anomaly detection,ensemble learning,unsupervised learning,temporal data,dependable and robust learning.},\ndoi={10.1109/TNSM.2021.3071928},\nISSN={1932-4537},\nurl = {https://ieeexplore.ieee.org/document/9399116},\nurl_Paper = {TNSM2021.pdf}\n}\n\n
\n
\n\n\n
\n Insider threat represents a major cybersecurity challenge to companies, organizations, and government agencies. Insider threat detection involves many challenges, including unbalanced data, limited ground truth, and possible user behaviour changes. This research presents an unsupervised learning based anomaly detection approach for insider threat detection. We employ four unsupervised learning methods with different working principles, and explore various representations of data with temporal information. Furthermore, different computational intelligence schemes are explored to combine these models to create anomaly detection ensembles for improving the detection performance. Evaluation results show that the approach allows learning from unlabelled data under challenging conditions for insider threat detection. Insider threats are detected with high detection and low false positive rates. For example, 60% of malicious insiders are detected under 0.1% investigation budget, and all malicious insiders are detected at at less than 5% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting new anomalous behaviours in different datasets, i.e. robustness. Finally, results demonstrate that a voting-based ensemble of anomaly detection can be used to improve detection performance as well as the robustness. Comparisons with the state-of-the-art confirm the effectiveness of the proposed approach.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Training regime influences to semi-supervised learning for insider threat detection.\n \n \n \n \n\n\n \n Le, D. C.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n In IEEE Security and Privacy Workshops (SPW '21), 2021. \n \n\n\n\n
\n\n\n\n \n \n \"Training paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 3 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_spw2021,\n abstract = {A malicious insider is one of the most damaging threats to any organization from industry to government agencies. Many challenges from insider threat detection come from the fact that the ground truth is very limited and costly to acquire. This paper presents a semi-supervised learning approach to insider threat detection. We employ three machine learning methods under different real-world conditions. These include obtaining the initial ground truth training data randomly or via a certain type of insider malicious behavior or by anomaly detection system scores. Evaluation results show that the approach allows learning from very limited data for insider threat detection at high precision. 90\\% of malicious data instances are detected under 1\\% false positive rate.},\n author = {Le, Duc C. and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},\n title = {Training regime influences to semi-supervised learning for insider threat detection},\n booktitle = {IEEE Security and Privacy Workshops (SPW '21)},\n year = {2021},\n _pages = {270-275},\n _doi = {10.1109/SPW.2018.00043},\n keywords = {semi-supervised learning, insider threat, malicious behavior, anomaly detection, data availability},\n _url = {},\n url_Paper = {wtmc2021.pdf}\n}\n\n
\n
\n\n\n
\n A malicious insider is one of the most damaging threats to any organization from industry to government agencies. Many challenges from insider threat detection come from the fact that the ground truth is very limited and costly to acquire. This paper presents a semi-supervised learning approach to insider threat detection. We employ three machine learning methods under different real-world conditions. These include obtaining the initial ground truth training data randomly or via a certain type of insider malicious behavior or by anomaly detection system scores. Evaluation results show that the approach allows learning from very limited data for insider threat detection at high precision. 90% of malicious data instances are detected under 1% false positive rate.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n
\n
\n  \n 2020\n \n \n (4)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n \n Analyzing Data Granularity Levels for Insider Threat Detection using Machine Learning.\n \n \n \n \n\n\n \n Le, D. C.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n IEEE Transactions on Network and Service Management, 17(1): 30–44. March 2020.\n \n\n\n\n
\n\n\n\n \n \n \"Analyzing paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 8 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n\n\n\n
\n 
@ARTICLE{Le_tnsm2020,\nauthor={Le, Duc C. and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},\njournal={IEEE Transactions on Network and Service Management},\ntitle={Analyzing Data Granularity Levels for Insider Threat Detection using Machine Learning},\nabstract = {Malicious insider attacks represent one of the most damaging threats to networked systems of companies and government agencies. There is a unique set of challenges that come with insider threat detection in terms of hugely unbalanced data, limited ground truth, as well as behaviour drifts and shifts. This work proposes and evaluates a machine learning based system for user-centered insider threat detection. Using machine learning, analysis of data is performed on multiple levels of granularity under realistic conditions for identifying not only malicious behaviours, but also malicious insiders. Detailed analysis of popular insider threat scenarios with different performance measures are presented to facilitate the realistic estimation of system performance. Evaluation results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders in unseen data with a high accuracy. Specifically, up to 85\\% of malicious insiders are detected at only 0.78\\% false positive rate. The system is also able to quickly detect the malicious behaviours, as low as 14 minutes after the first malicious action. Comprehensive result reporting allows the system to provide valuable insights to analysts in investigating insider threat cases.},\nyear={2020},\nvolume={17},\nnumber={1},\npages={30--44},\nkeywords={Insider threat;machine learning;data granularity.},\ndoi={10.1109/TNSM.2020.2967721},\nISSN={2373-7379},\nmonth=mar,\nurl_Paper = {TNSM2020.pdf}\n}\n\n\n
\n
\n\n\n
\n Malicious insider attacks represent one of the most damaging threats to networked systems of companies and government agencies. There is a unique set of challenges that come with insider threat detection in terms of hugely unbalanced data, limited ground truth, as well as behaviour drifts and shifts. This work proposes and evaluates a machine learning based system for user-centered insider threat detection. Using machine learning, analysis of data is performed on multiple levels of granularity under realistic conditions for identifying not only malicious behaviours, but also malicious insiders. Detailed analysis of popular insider threat scenarios with different performance measures are presented to facilitate the realistic estimation of system performance. Evaluation results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders in unseen data with a high accuracy. Specifically, up to 85% of malicious insiders are detected at only 0.78% false positive rate. The system is also able to quickly detect the malicious behaviours, as low as 14 minutes after the first malicious action. Comprehensive result reporting allows the system to provide valuable insights to analysts in investigating insider threat cases.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n A Frontier: Dependable, Reliable and Secure Machine Learning for Network/System Management.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n Journal of Network and Systems Management, 28(4): 827–849. October 2020.\n \n\n\n\n
\n\n\n\n \n \n \"APaper\n  \n \n \n \"A paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 2 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@Article{Le_jnsm2020,\nabstract = {Modern networks and systems pose many challenges to traditional management approaches. Not only the number of devices and the volume of network traffic are increasing exponentially, but also new network protocols and technologies require new techniques and strategies for monitoring controlling and managing up and coming networks and systems. Moreover, machine learning has recently found its successful applications in many fields due to its capability to learn from data to automatically infer patterns for network analytics. Thus, the deployment of machine learning in network and system management has become imminent. This work provides a review of the applications of machine learning in network and system management. Based on this review, we aim to present the current opportunities and challenges in and highlight the need for dependable, reliable and secure machine learning for network and system management.},\nauthor = {Le, Duc C. and Zincir-Heywood, Nur},\ndoi = {10.1007/s10922-020-09512-5},\nissn = {15737705},\njournal = {Journal of Network and Systems Management},\nkeywords = {Network and system management,Reliable and dependable machine learning,Secure machine learning},\nmonth = oct,\nnumber = {4},\npages = {827--849},\npublisher = {Springer},\ntitle = {{A Frontier: Dependable, Reliable and Secure Machine Learning for Network/System Management}},\nvolume = {28},\nyear = {2020},\nurl = {https://rdcu.be/b00ac},\nurl_paper={Le_SpringerJNSM2020.pdf}\n}\n\n
\n
\n\n\n
\n Modern networks and systems pose many challenges to traditional management approaches. Not only the number of devices and the volume of network traffic are increasing exponentially, but also new network protocols and technologies require new techniques and strategies for monitoring controlling and managing up and coming networks and systems. Moreover, machine learning has recently found its successful applications in many fields due to its capability to learn from data to automatically infer patterns for network analytics. Thus, the deployment of machine learning in network and system management has become imminent. This work provides a review of the applications of machine learning in network and system management. Based on this review, we aim to present the current opportunities and challenges in and highlight the need for dependable, reliable and secure machine learning for network and system management.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Exploring anomalous behaviour detection and classification for insider threat identification.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n International Journal of Network Management, Early access. March 2020.\n \n\n\n\n
\n\n\n\n \n \n \"Exploring paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 7 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n\n\n\n
\n 
@Article{Le_ijnm2020,\nauthor="Duc C. Le and Zincir-Heywood, Nur",\ntitle="Exploring anomalous behaviour detection and classification for insider threat identification",\njournal="International Journal of Network Management",\nvolume="Early access",\nyear="2020",\nmonth=mar,\nabstract="Recently, malicious insider threats represent one of the most damaging threats to companies and government agencies. Insider threat detection is a highly skewed data analysis problem, where the huge class imbalance makes the adaptation of learning algorithms to the real world context very difficult. This study proposes a new system for user-centered machine learning based anomaly behaviour and insider threat detection on multiple data granularity levels. System evaluations and analysis are performed not only on individual data instances but also on normal and malicious users. Our results show that the proposed system, which is a combination of unsupervised anomaly detection and supervised machine learning methods, can learn from unlabelled data and a very small amount of labelled data. Furthermore, it can generalize to bigger datasets for detecting anomalous behaviours and unseen malicious insiders with a high detection and a low false positive rate.",\ndoi="10.1002/nem.2109",\nurl_Paper = {IJNM_e2109.pdf}\n}\n\n
\n
\n\n\n
\n Recently, malicious insider threats represent one of the most damaging threats to companies and government agencies. Insider threat detection is a highly skewed data analysis problem, where the huge class imbalance makes the adaptation of learning algorithms to the real world context very difficult. This study proposes a new system for user-centered machine learning based anomaly behaviour and insider threat detection on multiple data granularity levels. System evaluations and analysis are performed not only on individual data instances but also on normal and malicious users. Our results show that the proposed system, which is a combination of unsupervised anomaly detection and supervised machine learning methods, can learn from unlabelled data and a very small amount of labelled data. Furthermore, it can generalize to bigger datasets for detecting anomalous behaviours and unseen malicious insiders with a high detection and a low false positive rate.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Exploring Adversarial Properties of Insider Threat Detection.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n In 2020 IEEE Conference on Communications and Network Security (CNS), June 2020. \n \n\n\n\n
\n\n\n\n \n \n \"Exploring paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 1 download\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n\n\n\n
\n 
@INPROCEEDINGS{Le_CNS2020,\nAUTHOR="Duc C. Le and Nur Zincir-Heywood",\nTITLE="Exploring Adversarial Properties of Insider Threat Detection",\nBOOKTITLE="2020 IEEE Conference on Communications and Network Security (CNS)",\nMONTH=jun,\nYEAR=2020,\nABSTRACT="Insider threat represents a major cybersecurity challenge to companies and\ngovernment agencies. The challenges in insider threat detection, includes\nunbalanced data, limited ground truth, and possible user behaviour changes.\nThis research presents an unsupervised machine learning (ML) based anomaly\ndetection approach for insider threat detection. We employ two ML methods\nwith different working principles, specifically autoencoder and isolation\nforest, and explore various representations of data with temporal\ninformation. Evaluation results show that the approach allows learning from\nunlabelled data in under adversarial conditions for insider threat\ndetection with a high detection and a low false positive rate. For example,\n60\\% of malicious insiders are detected under 0.1\\% investigation budget.\nFurthermore, we explore the ability of the proposed approach to generalize\nfor detecting unseen anomalous behaviours in different datasets, i.e.\nrobustness. Comparisons with other work in the literature confirm the\neffectiveness of the proposed approach.",\nurl_Paper = {CNS20.pdf}\n}\n\n
\n
\n\n\n
\n Insider threat represents a major cybersecurity challenge to companies and government agencies. The challenges in insider threat detection, includes unbalanced data, limited ground truth, and possible user behaviour changes. This research presents an unsupervised machine learning (ML) based anomaly detection approach for insider threat detection. We employ two ML methods with different working principles, specifically autoencoder and isolation forest, and explore various representations of data with temporal information. Evaluation results show that the approach allows learning from unlabelled data in under adversarial conditions for insider threat detection with a high detection and a low false positive rate. For example, 60% of malicious insiders are detected under 0.1% investigation budget. Furthermore, we explore the ability of the proposed approach to generalize for detecting unseen anomalous behaviours in different datasets, i.e. robustness. Comparisons with other work in the literature confirm the effectiveness of the proposed approach.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n
\n
\n  \n 2019\n \n \n (5)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n \n Machine learning based Insider Threat Modelling and Detection.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, A. N.\n\n\n \n\n\n\n In IFIP/IEEE International Symposium on Integrated Network Management, Washington DC, USA, April 2019. \n \n\n\n\n
\n\n\n\n \n \n \"Machine paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 2 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n\n\n\n
\n 
@inproceedings{Le_dissect2019,\nabstract = {Recently, malicious insider attacks represent one of the most damaging threats to companies and government agencies. This paper proposes  a new framework in constructing a user-centered machine learning based insider threat detection system on multiple data granularity levels. System evaluations and analysis are performed not only on individual data instances but also on normal and malicious insiders, where insider scenario specific results and delay in detection are reported and discussed. Our results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders with a high accuracy.},\nauthor = {Le, Duc C. and Zincir-Heywood, A. Nur},\nbooktitle={IFIP/IEEE International Symposium on Integrated Network Management}, \ntitle={Machine learning based Insider Threat Modelling and Detection}, \nyear={2019},\nmonth=apr,\naddress = {Washington DC, USA},\nurl_paper = {http://dl.ifip.org/db/conf/im/im2019-ws2-dissect/191805.pdf}\n}\n\n
\n
\n\n\n
\n Recently, malicious insider attacks represent one of the most damaging threats to companies and government agencies. This paper proposes a new framework in constructing a user-centered machine learning based insider threat detection system on multiple data granularity levels. System evaluations and analysis are performed not only on individual data instances but also on normal and malicious insiders, where insider scenario specific results and delay in detection are reported and discussed. Our results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders with a high accuracy.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Benchmarking Genetic Programming in Dynamic Insider Threat Detection.\n \n \n \n \n\n\n \n Le, D. C.; Heywood, M. I.; and Zincir-Heywood, N.\n\n\n \n\n\n\n In Proceedings of the Genetic and Evolutionary Computation Conference Companion, pages 385–386, July 2019. \n \n\n\n\n
\n\n\n\n \n \n \"BenchmarkingPaper\n  \n \n \n \"Benchmarking paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n\n \n  \n \n 3 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_Gecco2019,\n author = {Le, Duc C. and Heywood, Malcolm I. and Zincir-Heywood, Nur},\n title = {Benchmarking Genetic Programming in Dynamic Insider Threat Detection},\n booktitle = {Proceedings of the Genetic and Evolutionary Computation Conference Companion},\n _series = {GECCO '19},\n year = {2019},\n month=jul,\n isbn = {978-1-4503-6748-6},\n location = {Prague, Czech Republic},\n pages = {385--386},\n numpages = {2},\n url = {http://doi.acm.org/10.1145/3319619.3322029},\n doi = {10.1145/3319619.3322029},\n acmid = {3322029},\n _publisher = {ACM},\n _address = {New York, NY, USA},\n keywords = {cyber-security, dynamic environment, insider threat detection},\n url_paper = {le_gecco2019.pdf}\n} \n\n
\n
\n\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Learning From Evolving Network Data for Dependable Botnet Detection.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n In International Conference on Network and Service Management (CNSM 2019), Halifax, Canada, October 2019. \n \n\n\n\n
\n\n\n\n \n \n \"Learning paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 1 download\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n\n\n\n
\n 
@INPROCEEDINGS{Le_cnsm2019,\nAUTHOR="Duc C. Le and Nur Zincir-Heywood",\nTITLE="Learning From Evolving Network Data for Dependable Botnet Detection",\nBOOKTITLE="International Conference on Network and Service Management (CNSM 2019)",\nADDRESS="Halifax, Canada",\nDAYS=21,\nMONTH=oct,\nYEAR=2019,\nurl_Paper = {http://dl.ifip.org/db/conf/cnsm/cnsm2019/1570564953.pdf},\nABSTRACT="This work presents an emerging problem in real-world applications of\nmachine learning (ML) in cybersecurity, particularly in botnet detection,\nwhere the dynamics and the evolution in the deployment environments may\nrender the ML solutions inadequate. We propose an approach to tackle this\nchallenge using Genetic Programming (GP) - an evolutionary computation\nbased approach. Preliminary results show that GP is able to evolve\npre-trained classifiers to work under evolved (expanded) feature space\nconditions. This indicates the potential use of such an approach for botnet\ndetection under non-stationary environments, where much less data and\ntraining time are required to obtain a reliable classifier as new network\nconditions arise."\n}\n\n
\n
\n\n\n
\n This work presents an emerging problem in real-world applications of machine learning (ML) in cybersecurity, particularly in botnet detection, where the dynamics and the evolution in the deployment environments may render the ML solutions inadequate. We propose an approach to tackle this challenge using Genetic Programming (GP) - an evolutionary computation based approach. Preliminary results show that GP is able to evolve pre-trained classifiers to work under evolved (expanded) feature space conditions. This indicates the potential use of such an approach for botnet detection under non-stationary environments, where much less data and training time are required to obtain a reliable classifier as new network conditions arise.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Exploring Feature Normalization and Temporal Information for Machine Learning Based Insider Threat Detection.\n \n \n \n \n\n\n \n Ferreira, P.; Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n In International Conference on Network and Service Management (CNSM 2019), Halifax, Canada, October 2019. \n \n\n\n\n
\n\n\n\n \n \n \"Exploring paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n\n\n\n
\n 
@INPROCEEDINGS{Ferreira_cnsm2019,\nAUTHOR="Pedro Ferreira and Duc C. Le and Nur Zincir-Heywood",\nTITLE="Exploring Feature Normalization and Temporal Information for Machine\nLearning Based Insider Threat Detection",\nBOOKTITLE="International Conference on Network and Service Management (CNSM 2019)",\nADDRESS="Halifax, Canada",\nurl_Paper = {http://dl.ifip.org/db/conf/cnsm/cnsm2019/1570566066.pdf},\nDAYS=21,\nMONTH=oct,\nYEAR=2019,\nKEYWORDS="Insider Threat Detection; data normalization; temporal information",\nABSTRACT="Insider threat is one of the most damaging cybersecurity attacks to\ncompanies and organizations. The threats are also hard to detect, largely\ndue to its nature that malicious actions are performed by the insiders. In\nthis paper, we explore different techniques to leverage spatial and\ntemporal characteristics of user behaviours (actions). In particular,\nfeature normalization (scaling) techniques and a scheme for representing\nexplicit temporal information are explored to improve the performance of\nthe machine learning based insider threat detection systems. The obtained\nresults show that these data characteristics have different effects on\ndifferent insider threat classifiers. This shows a promising future\nresearch direction for further analysis of different user behaviours."\n}\n\n
\n
\n\n\n
\n Insider threat is one of the most damaging cybersecurity attacks to companies and organizations. The threats are also hard to detect, largely due to its nature that malicious actions are performed by the insiders. In this paper, we explore different techniques to leverage spatial and temporal characteristics of user behaviours (actions). In particular, feature normalization (scaling) techniques and a scheme for representing explicit temporal information are explored to improve the performance of the machine learning based insider threat detection systems. The obtained results show that these data characteristics have different effects on different insider threat classifiers. This shows a promising future research direction for further analysis of different user behaviours.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Dynamic Insider Threat Detection Based on Adaptable Genetic Programming.\n \n \n \n \n\n\n \n Le, D. C.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n In IEEE Symposium Series on Computational Intelligence (SSCI '19), 2019. \n \n\n\n\n
\n\n\n\n \n \n \"Dynamic paper\n  \n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 2 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_ssci2019,\nabstract = {Different variations in deployment environments of machine learning techniques may affect the performance of the implemented systems. The variations may cause changes in the data for machine learning solutions, such as in the number of classes and the extracted features. This paper investigates the capabilities of Genetic Programming (GP) for malicious insider detection in corporate environments under such changes. Assuming a Linear GP detector, techniques are introduced to allow a previously trained GP population to adapt to different changes in the data. The experiments and evaluation results show promising insider threat detection performances of the techniques in comparison with training machine learning classifiers from scratch. This reduces the amount of data needed and computation requirements for obtaining dependable insider threat detectors under new conditions.},\nauthor = {Le, Duc C. and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},\nbooktitle = {IEEE Symposium Series on Computational Intelligence (SSCI '19)},\n_doi = {10.1109/SSCI.2016.7850078},\nkeywords = {insider threat detection, cyber-security, dynamic environment},\ntitle = {Dynamic Insider Threat Detection Based on Adaptable Genetic Programming},\nyear = {2019},\nurl_Paper = {2019_CISDA.pdf}\n}\n\n
\n
\n\n\n
\n Different variations in deployment environments of machine learning techniques may affect the performance of the implemented systems. The variations may cause changes in the data for machine learning solutions, such as in the number of classes and the extracted features. This paper investigates the capabilities of Genetic Programming (GP) for malicious insider detection in corporate environments under such changes. Assuming a Linear GP detector, techniques are introduced to allow a previously trained GP population to adapt to different changes in the data. The experiments and evaluation results show promising insider threat detection performances of the techniques in comparison with training machine learning classifiers from scratch. This reduces the amount of data needed and computation requirements for obtaining dependable insider threat detectors under new conditions.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n
\n
\n  \n 2018\n \n \n (4)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n \n Unsupervised Monitoring of Network and Service Behaviour Using Self Organizing Maps.\n \n \n \n \n\n\n \n Le, D. C.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n Journal of Cyber Security and Mobility, 8(2): 15–52. 2018.\n \n\n\n\n
\n\n\n\n \n \n \"UnsupervisedPaper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 2 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@article{Le_jcsm2018,\nabstract = {Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. This paper investigates the capability of the Self Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, the aim is to understand how far such an approach could be pushed to analyze the network traffic, and to detect malicious behaviours in the wild. To this end, three different unsupervised SOM training scenarios for different data acquisition conditions are designed, implemented and evaluated. The approach is evaluated on publicly available network traffic (flows) and web server access (web requests) datasets. The results show that the approach has a high potential as a data analytics tool on unknown traffic/web service requests, and unseen attack behaviours. Malicious behaviours both on network and service datasets used could be identified with a high accuracy. Furthermore, the approach achieves comparable performances to that of popular supervised and unsupervised learning methods in the literature. Last but not the least, it provides unique visualization capabilities for enabling a simple yet effective network/service data analytics for security management.},\nauthor = {Duc C. Le and A. Nur Zincir-Heywood and Malcolm I. Heywood},\njournal = {Journal of Cyber Security and Mobility},\nkeywords = {network and service data analysis, unsupervised learning, malicious behaviour analysis},\nnumber = {2},\npages = {15--52},\ntitle = {Unsupervised Monitoring of Network and Service Behaviour Using Self Organizing Maps},\nvolume = {8},\nissue = {1},\nyear = {2018},\nurl = {https://www.riverpublishers.com/journal_read_html_article.php?j=JCSM/8/1/2},\ndoi = {10.13052/jcsm2245-1439.812}\n}\n\n\n
\n
\n\n\n
\n Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. This paper investigates the capability of the Self Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, the aim is to understand how far such an approach could be pushed to analyze the network traffic, and to detect malicious behaviours in the wild. To this end, three different unsupervised SOM training scenarios for different data acquisition conditions are designed, implemented and evaluated. The approach is evaluated on publicly available network traffic (flows) and web server access (web requests) datasets. The results show that the approach has a high potential as a data analytics tool on unknown traffic/web service requests, and unseen attack behaviours. Malicious behaviours both on network and service datasets used could be identified with a high accuracy. Furthermore, the approach achieves comparable performances to that of popular supervised and unsupervised learning methods in the literature. Last but not the least, it provides unique visualization capabilities for enabling a simple yet effective network/service data analytics for security management.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n Big Data in Network Anomaly Detection.\n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, N.\n\n\n \n\n\n\n In Sakr, S.; and Zomaya, A., editor(s), Encyclopedia of Big Data Technologies, pages 1–9. Springer International Publishing, 2018.\n \n\n\n\n
\n\n\n\n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n\n \n  \n \n 1 download\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n\n\n\n
\n 
@incollection{Le_2018,\nauthor="Le, Duc C.\nand Zincir-Heywood, Nur",\neditor="Sakr, Sherif\nand Zomaya, Albert",\ntitle="Big Data in Network Anomaly Detection",\nbookTitle="Encyclopedia of Big Data Technologies",\nyear="2018",\npublisher="Springer International Publishing",\npages="1--9",\nisbn="978-3-319-63962-8",\ndoi="10.1007/978-3-319-63962-8_161-1",\n_url="https://doi.org/10.1007/978-3-319-63962-8_161-1"\n}\n\n
\n
\n\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Benchmarking Evolutionary Computation Approaches to Insider Threat Detection.\n \n \n \n \n\n\n \n Le, D. C.; Khanchi, S.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n In Genetic and Evolutionary Computation Conference (GECCO '18), pages 1286–1293, 2018. \n Best paper award - RWA track\n\n\n\n
\n\n\n\n \n \n \"Benchmarking paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 4 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_gecco2018,\n abstract = {Insider threat detection represents a challenging problem to compa- nies and organizations where malicious actions are performed by authorized users. This is a highly skewed data problem, where the huge class imbalance makes the adaptation of learning algorithms to the real world context very difficult. In this work, applications of genetic programming (GP) and stream active learning are evaluated for insider threat detection. Linear GP with lexicase/multi-objective selection is employed to address the problem under a stationary data assumption. Moreover, streaming GP is employed to address the problem under a non-stationary data assumption. Experiments conducted on a publicly available corporate data set show the capa- bility of the approaches in dealing with extreme class imbalance, stream learning and adaptation to the real world context.},\n author = {Le, Duc C. and Khanchi, Sara and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},\n title = {Benchmarking Evolutionary Computation Approaches to Insider Threat Detection},\n booktitle = {Genetic and Evolutionary Computation Conference (GECCO '18)},\n year = {2018},\n pages = {1286--1293},\n _url = {http://doi.acm.org/10.1145/3205455.3205612},\n doi = {10.1145/3205455.3205612},\n keywords = {cyber-security, insider threat detection},\n url_Paper = {lcd_gecco18.pdf},\n note = {Best paper award - RWA track},\n} \n\n\n
\n
\n\n\n
\n Insider threat detection represents a challenging problem to compa- nies and organizations where malicious actions are performed by authorized users. This is a highly skewed data problem, where the huge class imbalance makes the adaptation of learning algorithms to the real world context very difficult. In this work, applications of genetic programming (GP) and stream active learning are evaluated for insider threat detection. Linear GP with lexicase/multi-objective selection is employed to address the problem under a stationary data assumption. Moreover, streaming GP is employed to address the problem under a non-stationary data assumption. Experiments conducted on a publicly available corporate data set show the capa- bility of the approaches in dealing with extreme class imbalance, stream learning and adaptation to the real world context.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n \n Evaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning.\n \n \n \n \n\n\n \n Le, D. C.; and Zincir-Heywood, A. N.\n\n\n \n\n\n\n In IEEE Security and Privacy Workshops (SPW '18), pages 270-275, San Francisco, CA, USA, 2018. \n \n\n\n\n
\n\n\n\n \n \n \"EvaluatingPaper\n  \n \n \n \"Evaluating paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 2 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_spw2018,\n abstract = {Insider threat is a prominent cyber-security dan- ger faced by organizations and companies. In this research, we study and evaluate an insider threat detection workflow using supervised and unsupervised learning algorithms. To this end, we study data exploration and analysis, anomaly detection and malicious behaviour classification on a publicly available data set. We evaluate several supervised and unsupervised learning algorithms - HMM, SOM, and DT - using this workflow.},\n author = {Le, Duc C. and Zincir-Heywood, A. Nur},\n title = {Evaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning},\n booktitle = {IEEE Security and Privacy Workshops (SPW '18)},\n year = {2018},\n address = {San Francisco, CA, USA},\n pages = {270-275},\n doi = {10.1109/SPW.2018.00043},\n keywords = {Insider Threat Detection, Unsupervised Machine Learning, Supervised Machine Learning, Anomaly detection, Behaviour Classification},\n url = {https://ieeexplore.ieee.org/abstract/document/8424659/},\n url_Paper = {lcd_spw2018.pdf}\n}\n\n
\n
\n\n\n
\n Insider threat is a prominent cyber-security dan- ger faced by organizations and companies. In this research, we study and evaluate an insider threat detection workflow using supervised and unsupervised learning algorithms. To this end, we study data exploration and analysis, anomaly detection and malicious behaviour classification on a publicly available data set. We evaluate several supervised and unsupervised learning algorithms - HMM, SOM, and DT - using this workflow.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n
\n
\n  \n 2016\n \n \n (1)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n \n Data analytics on network traffic flows for botnet behaviour detection.\n \n \n \n \n\n\n \n Le, D. C.; Zincir-Heywood, A. N.; and Heywood, M. I.\n\n\n \n\n\n\n In IEEE Symposium Series on Computational Intelligence (SSCI '16), 2016. \n \n\n\n\n
\n\n\n\n \n \n \"Data paper\n  \n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n  \n \n 3 downloads\n \n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Le_ssci2016,\nabstract = {Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. In this paper, we investigate the capability of employing the Self-Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, our aim is to understand how far such an approach could be pushed to analyze unknown traffic to detect botnets. To this end, we employed three different unsupervised training schemes using publicly available botnet data sets. Our results show that SOMs possess high potential as a data analytics tool on unknown traffic. They can identify the botnet and normal flows with high confidence approximately 99{\\%} of the time on the data sets employed in this work.},\nauthor = {Le, Duc C. and Zincir-Heywood, A. Nur and Heywood, Malcolm I.},\nbooktitle = {IEEE Symposium Series on Computational Intelligence (SSCI '16)},\ndoi = {10.1109/SSCI.2016.7850078},\nisbn = {9781509042401},\nkeywords = {anomaly detection systems,botnet behaviour detection,computer network security,data analytics,self-organising feature maps,unsupervised learning},\ntitle = {Data analytics on network traffic flows for botnet behaviour detection},\nyear = {2016},\nurl_Paper = {SSCI16_paper_229.pdf}\n}\n
\n
\n\n\n
\n Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. In this paper, we investigate the capability of employing the Self-Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, our aim is to understand how far such an approach could be pushed to analyze unknown traffic to detect botnets. To this end, we employed three different unsupervised training schemes using publicly available botnet data sets. Our results show that SOMs possess high potential as a data analytics tool on unknown traffic. They can identify the botnet and normal flows with high confidence approximately 99% of the time on the data sets employed in this work.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n
\n
\n  \n 2015\n \n \n (2)\n \n \n
\n
\n \n \n
\n \n\n \n \n \n \n \n A Contribution to Performance Analysis Approach of the IEEE 802.11 EDCA in Wireless Multi-hop Networks.\n \n \n \n\n\n \n Hoang, M. T.; Hoang, M.; and Le, D. C.\n\n\n \n\n\n\n VNU Journal of Science: Comp. Science & Com. Eng, 31(1): 45–54. 2015.\n \n\n\n\n
\n\n\n\n \n\n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@article{Hoang2015,\nabstract = {The IEEE 802.11e standard has been introduced to support service differentiation for wireless local area networks. In wireless multi-hop networks, the performance of IEEE 802.11e EDCA has to confront with some practical problems such as unsaturation traffic and hidden node problem. Hence, this problem has attracted numerous studies in recent years, in which several investigations use analytic model to evaluate the performance due to its accuracy aspect. However, the accuracy and complexity of analytical model depends on a range of assumed parameters. The complexity caused by the introduction of realistic conditions in wireless multi-hop networks is the major challenge of current studies in this field. To overcome this challenge, this paper proposes an analytical model which covers full specification of IEEE 802.11e EDCA. To reduce the complexity, the model is simplified by decomposing the problem in two models based on Markov chain that can be easily solved by numerical method. The proposed model is presented in the theoretical aspect as well as numerical results to clarify its accuracy.},\nauthor = {Hoang, Minh Trong and Hoang, Minh and Le, Duc C.},\njournal = {VNU Journal of Science: Comp. Science {\\&} Com. Eng},\nkeywords = {Hidden node,IEEE 80211e EDCA,Markov chain,Multi-hop network,Virtual collision},\nnumber = {1},\npages = {45--54},\ntitle = {A Contribution to Performance Analysis Approach of the IEEE 802.11 EDCA in Wireless Multi-hop Networks},\nvolume = {31},\nyear = {2015}\n}\n\n\n
\n
\n\n\n
\n The IEEE 802.11e standard has been introduced to support service differentiation for wireless local area networks. In wireless multi-hop networks, the performance of IEEE 802.11e EDCA has to confront with some practical problems such as unsaturation traffic and hidden node problem. Hence, this problem has attracted numerous studies in recent years, in which several investigations use analytic model to evaluate the performance due to its accuracy aspect. However, the accuracy and complexity of analytical model depends on a range of assumed parameters. The complexity caused by the introduction of realistic conditions in wireless multi-hop networks is the major challenge of current studies in this field. To overcome this challenge, this paper proposes an analytical model which covers full specification of IEEE 802.11e EDCA. To reduce the complexity, the model is simplified by decomposing the problem in two models based on Markov chain that can be easily solved by numerical method. The proposed model is presented in the theoretical aspect as well as numerical results to clarify its accuracy.\n
\n\n\n
\n\n\n
\n \n\n \n \n \n \n \n On the Effectiveness of Different Botnet Detection Approaches.\n \n \n \n\n\n \n Haddadi, F.; Le, D. C.; Porter, L.; and Zincir-Heywood, A. N.\n\n\n \n\n\n\n In 11th International Conference on Information Security Practice and Experience (ISPEC '15), pages 121–135, 2015. \n \n\n\n\n
\n\n\n\n \n\n \n \n doi\n  \n \n\n \n link\n  \n \n\n bibtex\n \n\n \n  \n \n abstract \n \n\n \n\n \n \n \n \n \n \n \n\n  \n \n \n \n \n \n \n \n \n\n\n\n
\n 
@inproceedings{Haddadi,\nabstract = {Botnets represent one of the most significant threats against cyber security. They employ different techniques, topologies and commu-nication protocols in different stages of their lifecycle. Hence, identifying botnets have become very challenging specifically given that they can upgrade their methodology at any time. In this work, we investigate four different botnet detection approaches based on the technique used and type of data employed. Two of them are public rule based systems (BotHunter and Snort) and the other two are data mining based tech-niques with different feature extraction methods (packet payload based and traffic flow based). The performance of these systems range from 0{\\%} to 100{\\%} on the five publicly available botnet data sets employed in this work. We discuss the evaluation results for these different systems, their features and the models learned by the data mining based techniques.},\nauthor = {Haddadi, Fariba and Le, Duc C. and Porter, Laura and Zincir-Heywood, A. Nur},\ntitle     = {On the Effectiveness of Different Botnet Detection Approaches},\nbooktitle = {11th International Conference on Information Security Practice and Experience ({ISPEC} '15)}, \nkeywords = {Botnet detection,Feature extraction,Traffic analysis},\npages = {121--135},\nyear = {2015},\ndoi = {10.1007/978-3-319-17533-1_9}\n}\n\n
\n
\n\n\n
\n Botnets represent one of the most significant threats against cyber security. They employ different techniques, topologies and commu-nication protocols in different stages of their lifecycle. Hence, identifying botnets have become very challenging specifically given that they can upgrade their methodology at any time. In this work, we investigate four different botnet detection approaches based on the technique used and type of data employed. Two of them are public rule based systems (BotHunter and Snort) and the other two are data mining based tech-niques with different feature extraction methods (packet payload based and traffic flow based). The performance of these systems range from 0% to 100% on the five publicly available botnet data sets employed in this work. We discuss the evaluation results for these different systems, their features and the models learned by the data mining based techniques.\n
\n\n\n
\n\n\n\n\n\n
\n
\n\n\n\n\n
\n\n\n \n\n \n \n \n \n\n
\n"}; document.write(bibbase_data.data);