Modern network intrusion detection systems must be able to handle large and fast changing
data, often also taking into account real-time requirements. Ensemble-based data mining …

We analyze the problem of designing pattern recognition systems in adversarial settings,
under an engineering viewpoint, motivated by their increasing exploitation in security …

Clustering algorithms have become a popular tool in computer security to analyze the
behavior of malware variants, identify novel malware families, and generate signatures for …

Clustering algorithms have been increasingly adopted in security applications to spot
dangerous or illicit activities. However, they have not been originally devised to deal with …

In this paper, we present ExecScent, a novel system that aims to mine new, previously
unknown C&C domain names from live enterprise network traffic. ExecScent automatically …

Malware programs currently represent the most serious threat to computer information
systems. Despite the performed efforts of researchers in this field, detection tools still have …

We study a dataset of billions of program binary files that appeared on 100 million
computers over the course of 12 months, discovering that 94% of these files were present on …

We present DECANTeR, a system to detect anomalous outbound HTTP communication,
which passively extracts fingerprints for each application running on a monitored host. The …

Ever growing Internet causes the availability of information. However, it also provides a
suitable space for malicious activities, so security is crucial in this virtual environment. The …

Clustering algorithms are largely adopted in security applications as a vehicle to detect
malicious activities, although few attention has been paid on preventing deliberate attacks …