About AMP Lab Projects Downloads Publications People Links

Group Member

Yimeng Zhang
Master Student

Personal Homepage:
Email: yimengz@cs.cmu.edu

Office: Newell Simon Hall 3612
Phone: 412-268-4083
Fax: 412-268-6298

Mailing Address:
Language Technology Institute of Computer Science,
Carnegie Mellon University,
5000 Forbes Avenue, Pittsburgh,
PA 15213-3890

[Research Interests] [Project] [Publications]

Research Interests

I am interested in Data mining, Machine Learning, Intrusion Detection, and Natual Language Processing.

Research Focus:

Intrusion Alert Analysis

Design data mining or machine learning algorithms to help analyze alerts generated from intrusion detection systems.

Masquerade Detection

Design machine learning algorithms to detect masquerades to the systems.

Machine Learning Framework for Intrusion Detection

Build a library or framework for machine learning based algorithms of intrusion detection.

Top of this page

Projects

Intrusion Detection and Event Analysis System

We design machine learning techniques for intrusion detection and intrusion data analysis. We have focused on techniques for analyzing alerts generated from intrusion detection systems.

Current Intrusion Detection Systems (IDSs) generate an unmanageable amount of alerts every day, and up to 99% of these alerts are false alerts. As a result, it is difficult for human users to understand the alerts and take appropriate actions. In this paper, we will provide a number of techniques based on activity graphs to address this issue. To help manage the large amount of alerts, we aggregate raw alerts into scenarios using alert correlation techniques, and build activity graphs from each scenario. Thus we provide the user these activity graphs that indicate the activities taken place in the specific systems, instead of the unmanageable amount of raw alerts. In order to reduce false alerts, we classify the activity graphs into true attack strategies and normal scenarios. We present a system implementing the proposed algorithms with a graphical user interface. We do experiments with this system on Darpa 1999, 2000 and a real world datasets. Experimental results show that the activity graphs help to reduce the workload for analyzing the large volume of alerts, and classifying attack graphs is much more effective and efficient than reducing individual false alerts.

A system is built in Java and PHP with our algorithms. The system provides a Java based graphical user interface as the left figure, and a PHP based web interface .

Please refer to the Intrusion Detection and Event Analysis System for more details.

Top of this page

Publications

Conference Papers:

Yimeng Zhang, Shumian He, Satoshi Oyama, Keishi Tajima, Katsumi Tanaka, "Discovery of Semantically Related Topics for Given Time Series Data," Data Engineering Workshop,Okinawa, Japan, 2006.

Journal Papers:

Yimeng Zhang and Tsuhan Chen, "Activity Graph for Alert Analysis," submitted to Statistical Methods for Network Security and Forensics, a special issue of IEEE Transactions on Information Forensics and Security
Yimeng Zhang, Shumian He, Satoshi Oyama, Keishi Tajima, Katsumi Tanaka, "Discovery of Semantically Related Topics for Given Time Series Data," Database Society of Japan,Vol. 5, No. 1, 2006.

Top of this page