Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform evaluation on five classifiers: Gaussian Naïve Bayes, Gaussian Naïve Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21%-73.3%, while the FPR is deteriorated only slightly (0.1%-1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.

Linking authors of short-text contents has important usages in many applications, including Named Entity Recognition (NER) and human community detection. However, certain challenges lie ahead. Firstly, the input short-text contents are noisy, ambiguous, and do not follow the grammatical rules. Secondly, traditional text mining methods fail to effectively extract concepts through words and phrases. Thirdly, the textual contents are temporally skewed, which can affect the semantic understanding by multiple time facets. Finally, using knowledge-bases can make the results biased to the content of the external database and deviate the meaning from the input short text corpus. To overcome these challenges, we devise a neural network-based temporal-textual framework that generates the subgraphs with highly correlated authors from short-text contents. Our approach, on the one hand, computes the relevance score (edge weight) between the authors through considering a portmanteau of contents and concepts, and on the other hand, employs a stack-wise graph cutting algorithm to extract the communities of the related authors. Experimental results show that compared to other knowledge-centered competitors, our multi-aspect vector space model can achieve a higher performance in linking short-text authors. In addition, given the author linking task, the more comprehensive the dataset is, the higher the significance of the extracted concepts will be.

An alarm is raised due to a defect in a transportation system. Given a graph over which the alarms propagate, we aim to exploit a set of subgraphs with highly correlated nodes (or entities). The edge weight between each pair of entities can be computed using the temporal dynamics of the propagation process. We retrieve the top k edge weights and each group of connected entities can consequently form a tightly coupled subgraph. However, numerous challenges abound. First, the textual contents associated with the alarms of the same type differ during the propagation process. Hence, in the lack of textual data, the temporal information can only be employed to compute the correlation weights. Second, in many scenarios, the same alarm does not propagate. Third, given a pair of entities, the propagation can occur in both directions. Most of the prior work only consider the time-window and assume that the propagation between a pair of entities occurs sequentially. But, the propagation process should be inferred using miscellaneous temporal features. Therefore, we devise a generative approach that, on the one hand, utilizes infinite temporal latent factors (e.g. hour, day, and etc.) to compute the correlation weights, and on the other hand, analyzes how an alarm in one entity can cause a set of alarms in another. We also conduct an extensive set of experiments to compare the performance of the subgraph mining methods. The results show that our unified framework can effectively exploit the tightly coupled subgraphs.