TY - GEN
T1 - An incident analysis system NICTER and its analysis engines based on data mining techniques
AU - Inoue, Daisuke
AU - Yoshioka, Katsunari
AU - Eto, Masashi
AU - Yamagata, Masaya
AU - Nishino, Eisuke
AU - Takeuchi, Junnichi
AU - Ohkouchi, Kazuya
AU - Nakao, Koji
PY - 2009/9/21
Y1 - 2009/9/21
N2 - Malwares are spread all over cyberspace and often lead to serious security incidents. To grasp the present trends of malware activities, there are a number of ongoing network monitoring projects that collect large amount of data such as network traffic and IDS logs. These data need to be analyzed in depth since they potentially contain critical symptoms, such as an outbreak of new malware, a stealthy activity of botnet and a new type of attack on unknown vulnerability, etc. We have been developing the Network Incident analysis Center for Tactical Emergency Response (NICTER), which monitors a wide range of networks in real-time. The NICTER deploys several analysis engines taking advantage of data mining techniques in order to analyze the monitored traffics. This paper describes a brief overview of the NICTER, and its data mining based analysis engines, such as Change Point Detector (CPD), Self-Organizing Map analyzer (SOM analyzer) and Incident Forecast engine (IF).
AB - Malwares are spread all over cyberspace and often lead to serious security incidents. To grasp the present trends of malware activities, there are a number of ongoing network monitoring projects that collect large amount of data such as network traffic and IDS logs. These data need to be analyzed in depth since they potentially contain critical symptoms, such as an outbreak of new malware, a stealthy activity of botnet and a new type of attack on unknown vulnerability, etc. We have been developing the Network Incident analysis Center for Tactical Emergency Response (NICTER), which monitors a wide range of networks in real-time. The NICTER deploys several analysis engines taking advantage of data mining techniques in order to analyze the monitored traffics. This paper describes a brief overview of the NICTER, and its data mining based analysis engines, such as Change Point Detector (CPD), Self-Organizing Map analyzer (SOM analyzer) and Incident Forecast engine (IF).
UR - http://www.scopus.com/inward/record.url?scp=70349145395&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=70349145395&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-02490-0_71
DO - 10.1007/978-3-642-02490-0_71
M3 - Conference contribution
AN - SCOPUS:70349145395
SN - 3642024890
SN - 9783642024894
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 579
EP - 586
BT - Advances in Neuro-Information Processing - 15th International Conference, ICONIP 2008, Revised Selected Papers
T2 - 15th International Conference on Neuro-Information Processing, ICONIP 2008
Y2 - 25 November 2008 through 28 November 2008
ER -