Ricardo A. Calix

Text message corpus: Applying natural language processing to mobile device forensics

The average mobile device user sends a large quantity of text and other short messages. These text message data are of great value to law enforcement investigators who may be analyzing a suspects mobile device or social media profile for evidence of criminal activity. Current tools and methodologies for analyzing text and other short message data generally only allow for simple keyword searches, which is often a time-consuming task for law enforcement investigators. In addition, there are limited corpora available containing text message data. An initial corpus of text message data for experimental purposes has been developed and made available to the research community. A simple methodology is proposed for feature extraction. The format of the data is given as well as basic statistics, suggestions for possible use, and future work.

On the feasibility of an embedded machine learning processor for intrusion detection

Intrusion detection and prevention systems serve a pivotal role in securing computer networks. Using machine learning for an intrusion detection system is important for stopping new attacks that do not have known signatures. Lowering the barrier to entry for microprocessor-based systems has enabled the use of specialized machine learning coprocessors to improve analysis performance. This paper proposes a machine learning approach on a small, low-powered embedded system that uses network-based features to distinguish between normal and abnormal network traffic. A hardware-based approach using a machine learning coprocessor is compared with a software-based approach. Machine learning processors can improve power consumption and processing speed especially when dealing with dig data sets. Results of the analysis show that the machine learning coprocessor obtains 66.67% classification accuracy. Additional results are presented and discussed.

On the Anatomy of the Dynamic Behavior of Polymorphic Viruses

The sophistication of novel strains of polymorphic viruses, such as Stuxnet, has increased over the last decade. Traditional tools such as anti-virus, firewalls, intrusion detection/prevention systems, etc. may be incapable of detecting such strains. As a result, new methods need to be introduced in order to detect this family of malware. Combining dynamic malware analysis techniques with machine learning tools can prove useful in the progression of developing an effective and efficient classifier. This paper explores the use of dynamic analysis of malware and machine learning to create a classifier for polymorphic virus detection.

Analysis of a Payload-based Network Intrusion Detection System Using Pattern Recognition Processors

Intrusion detection systems are a necessary tool to protect computer networks from cyber-attacks. Analyzing the payload of a packet can help in identifying strings that can help to detect attacks. Machine learning can be used to train models based on feature extraction of packet payloads. One important issue is that payload based intrusion detection systems may be too slow for standard processing approaches. Analyzing payloads has advantages over analyzing the standard headers of a packet. However, this approach is more resource intensive. The purpose of this study is to analyze the speed and accuracy performance of a payload based network intrusion detection system using pattern recognition processor with a unigram feature extraction approach. Results of the study are presented and discussed.

Analysis of Parallel Architectures for Network Intrusion Detection

Intrusion detection systems need to be both accurate and fast. Speed is important especially when operating at the network level. Additionally, many intrusion detection systems rely on signature based detection approaches. However, machine learning can also be helpful for intrusion detection. One key challenge when using machine learning, aside from the detection accuracy, is using machine learning algorithms that are fast. In this paper, several processing architectures are considered for use in machine learning based intrusion detection systems. These architectures include standard CPUs, GPUs, and cognitive processors. Results of their processing speeds are compared and discussed.