International Journal of Network Security, Vol.6, No.3, PP.

301–308, May 2008 301

A Method for Locating Digital Evidences with

Outlier Detection Using Support Vector Machine
Zaiqiang Liu, Dongdai Lin, and Fengdeng Guo
(Corresponding author: Zaiqiang Liu)

State Key Laboratory of Information Security, Institute of Software

Chinese Academy of Sciences, [Link] 8718, Beijing 100080, China (Email: liuzq@[Link])
(Received Apr. 6, 2006; revised and accepted July 31, 2006)

Abstract to assemble a list of words specific to the investigated in-

cident beforehand. Recently, Brain Carrier proposed a
One of the biggest challenges facing digital investigators target definition method using outlier analysis to auto-
is the sheer volume of data that must be searched in lo- mate the process of the searching for digital evidence [5],
cating the digital evidence. How to efficiently locate the and the results of the experiment show that the method
evidence relating to the computer crime while maintaining is feasible, but the false positive rate is still high. More
accuracy is becoming a research focus. In this paper, we research into the false rates of evidence searches is needed
introduce a two-tier method to automate the process of lo- to improve the process of digital forensics with automated
cating the digital evidence, which first employ a one-class techniques. In this paper, we propose a new outlier de-
Support Vector Machine (SVM) outlier detector to fil- tection method based on SVM to speed up the searching
ter out insignificant records for forensic investigators and process for digital evidence while improving the accuracy
then use a group of one-class SVM classifiers (trained with of locating potential evidence.
the expert knowledge or interested samples for an investi- The remainder of this paper is organized as follows.
gator based on a different feature vector) to further ana- Section 2 provides the introduction of generalized SVM
lyze the output of the outlier detector to improve the ac- algorithm. Section 3 introduces the automated technique
curacy of investigation. The effectiveness of the proposed of locating digital evidence that is based on SVM. Section
method for locating digital evidence is demonstrated us- 4 describes the process and results of experiments that
ing the public datasets: KDD Cup99 (Knowledge Discov- use our proposed methods to find network session that
ery and Data-mining) intrusion detection dataset. are potential evidence. Finally Section 5 concludes the
Keywords: Data mining, digital forensics, feature calcu- paper.
lation, support vector machine
2 Support Vector Machine
1 Introduction The SVM is a maximal margin algorithm that is based
mainly on work performed by Vladimir N. Vapnik and
A digital investigation is a process where investigators
coworkers, which was presented first in 1992 [1]. The
develop and test hypotheses that answer questions about
SVM was primarily constructed to solve binary classifica-
digital events. This process is achieved using the scientific
tion problems, and now has been improved to solve multi-
method where an investigator develops a hypothesis based
classification problems. It has much better qualities than
on the existing evidence that he finds and then tests the
other data mining techniques: good capacity for general-
hypothesis by looking for additional evidence that shows
ization; less susceptible to overfitting; efficient in dealing
the hypothesis is true or false [4]. During the process
with the problem of local optimum, etc.
of a digital investigation, the step of searching for dig-
The basic principle of SVM is to map feature vectors
ital evidence to support or refute the hypothesis is one
to a high dimensional space and to search a hyperplane
of the most time consuming tasks. Digital evidence is
that not only separates the training vectors from different
a kind of digital data that contains reliable information
classes, but also maximizes this separation by making the
that support or refute a hypothesis about the incident
margin as large as possible. This can be illustrated by a
being investigated [5]. The most common technique to
binary classification problem (see Figure 1), and described
search for digital evidence is the “string search” based on
as follows:
keywords provided by the investigators. This method is
usually simple and effective, but it requires investigators 1) Assume training dataset T = {(X1 , Y1 ), · · · (Xi , Yi )
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 302

Figure 2: Outlier detection framework for searching for

Figure 1: SVM hyperplane digital evidence

, · · · (Xl , Yl )} ∈ (χ × γ)l , where x ∈ χ = Rn , yi ∈ γ = It is most impractical in the process of investigation to ac-

{+1, −1}, i = 1, · · · , l; quire enough training datasets. Luckily, Scholkopf and his
coworkers have proposed a method to adapt the SVM al-
2) Seek an optimal hyperplane, such as {H|x·w+b = 0}
gorithm to the one-class classification problem [12], which
in Figure 1, between classes of points such that the
is called a one-class SVM algorithm. The basic strategy
distance between the closest points is maximized. It
of a one-class SVM algorithm is to identify “outliers” in
is equivalent to the solution of the following optimiza-
normal samples and regard them as anomalous samples,
tion problem:
and then the standard classification SVM techniques are
1 T
M inimize 2 w w + CΣi=1 ξi l employed. Therefore we can use this quality of one-class
T
Subject to yi (w Φ(Xi )) ≥ 1 − ξi , ξi > 0. SVM to build an evidence model with unlabelled datasets
that is easier to acquire. Section 3 details the proposed
Where training vectors xi are mapped into a higher methods about how to use SVM to locate digital evidence.
dimensional space by the function Φ(•)Rn → Rm ,
m > n, that can be linear or nonlinear; C > 0 is the
penalty parameter of the error term; w is a vector in 3 Proposed Methods for Search-
a high dimensional space Rm ; ing Digital Evidence
3) Transfer the above optimization problem into its dual
Usually outlier detection techniques can be applied in con-
problem. The above optimization problem is equiva-
ditions as follows: to cleanse the training dataset dur-
lent to the dual:
ing the data preprocessing process of data mining; and
M inimize 12 Σ1i=1 Σlj=1 yi yj αi αj KΦ (xi , xj ) + Σlj=1 αj to gain anomalous data sets of outliers that are often of
Subject to Σli=1 yi αi = 0, 0 ≤ αi ≤ C. particular interest to users. The process of searching for
digital evidence mainly uses the second aspect of the func-
Where KΦ (xi , xj ) = (Φ(xi ) · Φ(xi )) is a kernel func- tions of outlier detection techniques in order to identify
tion. Calculate and gain the optimal answer α∗ = potentially interested data or content that guides investi-
(α∗1 , α∗2 , · · · α∗l )T ; gators to further searching. The process often is carried
out when digital investigators have collected some known
4) Calculate w∗ and b∗ . Here w∗ = Σli=1 yi α∗i Φ(xi ), and evidence for collecting more relative evidence. But some-
choose {α∗j | 0 ≤ α∗j ≤ C} and calculate the b∗ = times there is no relative evidence with the current inves-
yj − Σli=1 yi α∗i KΦ (xj , xi ); tigated event before investigating, so digital investigators
need the guide to locate a piece of digital evidence in the
5) Calculate the decision function: case of being lost during the “looking for a needle” in a
bottle of “data”. Trying to resolve the above problem,
f (x) = sgn((w∗ · Φ(x)) + b∗ ) this paper introduces a method of searching digital evi-
= sgn(Σli=1 yi α∗i KΦ (x, xi ) + b∗ ). dence automatically. Our method employs the one-class
SVM technique as an outlier analysis method to find dig-
The above SVM algorithm is actually a supervised ital evidence from the file system image or captured net-
two-class classifier, so if we want to train the SVM, we work traffic dataset, which is relative to the investigated
must have the labelled datasets consisting of both posi- incident in time or space.
tive (normal) samples and negative (abnormal) samples. Unfortunately, it is difficult for investigators to choose
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 303

a point which can keep a low false negative rate while cidents. For more detail information about feature cal-
keeping a low false positive rate when using outlier de- culation, please refer to [9, 14]. However using too many
tection techniques. We resolve this problem by using a features for various incidents will cause the problem of
two-tier approach that combines outlier detection to re- over-fitting of both the Outlier Detector and the Post-
duce false negative rate with postprocessor to reduce false processor, which will increase the cost of calculation and
positive rate (see Figure 2). Datasets needing investiga- reduce accuracy. The best way is to select a subset of
tion are first preprocessed, and attributes describing the features used for the investigation. We analyzed various
target object are extracted from investigated datasets by combinations of features for their contribution to the Out-
the Feature Calculator. Then the Outlier Detector is em- lier Detector and the Postprocessor accuracy according
ployed to learn the ”outlier-ness” of the records of interest to the method proposed in [10]. The result of analyzing
to the investigators and to eliminate the records that have about the relationship between incident category and its
a high-probability of being normal. Then the outliers de- feature subset is described in Table 1.
tected by the Outlier Detector and the rest of the records
are passed on to Postprocessor which can be regarded as 3.2 Outlier Detector Using One-class
a secondary classifier to further determine whether they
SVM
are false positives from the outlier detector or potential
evidence with the support of existing knowledge consist- After extracting and selecting the suitable features, the
ing of expert knowledge and existing evidence samples. next step is to eliminate records that have a very high
Records outputted by the postprocessor will be labelled probability of being normal through an outlier detector.
as potential evidence samples that can be used as existing Although almost any anomaly detection methods could be
knowledge in the next iteration, and passed on to the Tar- applied, we employ a commonly used one-class Support
get Object unit to define or update the searching targets Vector Machine (SVM) with a modified Gaussian (RBF)
for further investigation. Repeat the above steps until kernel. The standard RBF kernel function is based on
the evidence of an incident which refutes or supports an the Euclidean Distance function. One weakness of the
investigation hypothesis [3] have been acquired. The for- basic Euclidean distance function is that if one of the in-
mal description of the above components is detailed in the put attributes has a relatively large range, then it can
following sections respectively. overwhelm the other attributes. For example, if there
are two attributes (A1 and A2), and A1 can have val-
ues from 1 to 10000, and A2 has values only from 1 to
3.1 Feature Calculator 10, then A2’s influence on the distance function could be
Feature Calculator (FC) is responsible for extracting fea- overwhelmed by A1’s influence. Besides this, it can not
tures from the original investigated data source. Feature effectively handle applications with both continuous and
extraction and selection from the available data is impor- nominal attributes. So we redefine the RBF kernel func-
tant to the effectiveness of the methods employed because tion as:
the great capability in selecting the suitable features of a −kD(x,y)k

classifier can lead directly to faster training and more ac- KΦ (x, y) = e δ2 .
curate results. Usually the selection of what kinds of fea- Where D(x, y) is the Heterogeneous Value Difference
tures depends on the target objects defined or constructed
Function (HVDM)[15] and defined as:
by the forensic investigator. In theory, the more easily to
select features, the more specific the target object is. In D(x, y) = (Σm 2 1
i=1 di (xi , yi )) .
2
fact, it is very difficult to define a clear target object be-
fore carrying out a forensic investigation of an incident. Where m is the number of attributes, di is the distance
But it is comparatively easy to identify the category the function for ith attribute and defined as:
investigated incident belongs to. So we categorize the tar- 
get object into five different classes R2L, DOS, Probe,  1, xi or yi unknown
U2R, Normal for network forensics. Where R2L de- di (xi , yi ) = dvdm (xi , yi ), xi and yi are nominal
ddif f (xi , yi ), xi and yi are numeric

notes unauthorized access from a remote machine, such as
guessing a password; DOS denotes denial-of-service, such Ni,x,j Ni,y,j
as smurf attack; U2R denotes unauthorized access to lo- where dvdm (xi , yi ) = Σkj=1 | Ni,x − Ni,y |, ddif f (xi , yi )
|xi −yi |
cal superuser privileges, such as various “buffer overflow” = 4σi , and
attacks; “probe” denotes surveillance and other probing,
such as host or port scanning [14]. • σi is the standard deviation of the numeric values of
Under the network environment, there are many traffic ith attribute;
features that can be used for intrusion detection or event • Ni,x is the number of instances in the training set T
analysis, such as, source address and port number, desti- that have value x for ith attribute;
nation address and port number, timestamp, etc. Stolfo
and his team have researched this topic in-depth and cal- • Ni,x,j is the number of instances in T that have value
culated 41 different features in all applied to various in- x for ith attribute and output class j;
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 304

Table 1: Relationship between categories and feature subsets

Category Feature subset vector Marker

R2L [3,5,6,32,33] FSV(r2l)
DOS [1,5,6,23,24,25,26,32,36,38,39] FSV(dos)
Probe [3,5,6,23,24,32,33] FSV(probe)
U2R [2,3,5,6,24,32,33] FSV(u2r)
Normal [1,2,3,4,5,6,10,17,23,27,28,29,33,36,39] FSV(norm)

Note: the numbers in the above “Feature Subset Vector” column are corresponding to the serial number of 41
various quantitative and qualitative features extracted in [14].

• K is the number of output classes in the problem

domain.
A one-class SVM uses the above kernel function
which transforms the unlabelled examples into a high-
dimensional feature space, and learns the support region
for “normal” data. In order to maximally separate the
“normal” data from the origin via a hyperplane bound-
ary, the one-class SVM needs to resolve the following
quadratic programming problem:

M inimize 21 wT w + vl1 l
Σi=1 ξi − p
Subject to yi (w · Φ(xi )) ≥ p − ξi , ξi ≥ 0, i = 1, · · · , l.

Where ξi is the slack parameter which associated with

each data example and denotes the possibility that some
of the training examples can be misclassified [13]; the pa-
rameter v ∈ (0, 1) controls the trade off between maxi-
Figure 3: Ideal detection point
mizing the distance from the origin and containing most
of the data in the region created by the hyperplane, and
is the upper bound on the ratio of outliers in training
dataset [13]; the parameter ρ is the offset, and the dis- select the balance point from the Expected Zone in Fig-
tance between the margin and the origin is ρ k w k. For a ure 3. The Detection Rate of the point S in Figure 3 can
more detailed explanation of SVM algorithm, see Section be a number equal or near to 100%. Finally the output
2. of the Outlier Detector that is deemed anomalous will be
The Outlier Detector is trained on unlabelled dataset passed on to the Postprocessor for further classification
consisting of feature vector FSV (norm) to gain a gener- to reduce the false positive rate.
alized profile of “normal” activity. By excluding a large Note that the Outlier Detector needs not create a
portion of the fringe normal records from the original model for anomalous data, but if there are some known
dataset, the outlier detector can identify, with high con- anomalous examples which can be used as training data
fidence, that certain subset of records are not anomalous. for the secondary classifier in the Postprocessor, it can
The rest of the original dataset will be anomalous, but improve the accuracy of the outlier detector.
with high false positives, and actually they are the data
points needed to pay attention by investigators. Usually
3.3 Postprocessor
the False Positives (FP) of a classifier is in conflict with its
True Positives (TP), so we have to improve the FP rate The Postprocessor functions as a group of classifiers used
of the classifier at the cost of its TP rate, and vice versa. to filter false positives from the output of the Outlier De-
In theory the ideal balance point will be the nearest point tector. While many artificial intelligence methods could
from the top-left point in the Receiver Operating Char- be applied to this task, we still employ one-class SVM al-
acteristic (ROC) curve [15]. See Figure 3, the ideal point gorithm with a modified Gaussian (RBF) kernel to imple-
will be the point T . However, most of the time the TP ment a group of classification models trained from anoma-
rate at the point T is not equal to 1, which means that lous records. For a more detailed explanation of SVM
a portion of samples are misclassified as normal, that is algorithm, see Section 3.2. In order to support inves-
to say, some potential evidence will be missed after the tigation on various network incidents, the Postprocessor
processing of the Outlier Detector. In order to reduce the builds four models with FSV(r2l), FSV(dos), FSV(probe),
probability of missing potential evidence samples, we can and FSV(u2r) respectively. An investigator can choose
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 305

one of the models (such as FSV(dos) model) to filter the • DS(u2r): DataSet(normal) ∪ DataSet(u2r);
false positives under the support of existing evidence or
knowledge (see Figure 4(a)), or the union of multiple mod- • DS(norm): DataSet(normal) ∪ DataSet(r2l) ∪
els, such as (see Figure 4(b)), to systematically evaluate DataSet(u2r) ∪ DataSet(dos) ∪ DataSet(probe).
the output of each classifier under the support of forensic
experts. Besides this, in order to build the classification mod-
The output of the Postprocessor will be the potential els for the Postprocessor, we randomly selected different
evidence or evidence snippet, and a forensic investigator number (K) of attack samples from the filtered attack
can define new target objects or employ other tools (such samples, and trained the classifiers.
as keyword searching tool) on the bases of the output for In order to measure the performance of the proposed
further investigation. method, the ROC curve is used. The ROC curve is a plot
of detection accuracy against the false positive rate [15].
It can be obtained by varying the detection threshold.
4 Experiments and Results Detection rate and false positive rate may be defined as
follows:
In this section, we introduce the experiment methods and
present initial results of the use of our proposed method Detection rate = T P/(T P + F N )
to detect outlier in intrusion detection databases. In all F alse positive rate = F P/(F P + T N ).
experiments we employ a SVM tool called LIBSVM [6]
and the modified RBF kernel. Where TP denotes true positives, FN denotes false nega-
tives, FP is false positives and TN is true negatives. Be-
4.1 Dataset sides this, both the Outlier Detector and the Postproces-
sor employ the SVM algorithm, and we hope that our
The data for our experiments was prepared by the 1999
SVMs can detect outliers with high accuracy, while clas-
DARPA intrusion detection evaluation program from
sifying normal examples with great confidence. This is
MIT Lincoln Labs [9]. The following experiments are
controlled to a great degree by the parameter v. In order
based on the 10% train data subset with 494,021 data
to reduce the complexity of the experiments, all exper-
records. Each record has 41 attributes for each connec-
iments were performed with constant value of v (0.125)
tion plus one class label, and the class label will only be
selected by a great deal of experiments.
used for testing, not participation in the classification.

4.2 Methods 4.3 Analysis of Results

Due to the raw dataset being collected in a simulated Five experiments have been done with the datasets gen-
network attack environment, the proportion of attack in- erated in the above section. The results of experiments
stances to normal ones in the KDD training dataset is very in Division Mode are presented in Figure 5(a-d).
high (over 400%). It is almost impossible in a true net- In the above figures, the parameter K is the number
work environment and it also breaches the basic precondi- of corresponding interested samples for training the Post-
tion of efficiently classification of interested instances for processor classifier. From the figures, we can see that the
the investigators. So we filtered some of attack instances Outlier Detector has good performance in rate of detec-
from the original and keep the proportion of attack in- tion, especially in Figure 5(a) the Detection Rate reaches
stances (outliers) in the range of [1%, 1.5%]. 92% while FP rate 0.43%. Besides this, when the results
The goal of the experiment is to separate the outlier of the Detector Outlier were pipelined to the Postpro-
from the above datasets and identify the impact of the cessor which was trained with the fewer training samples
Outlier Detector on the secondary classifier both in accu- (about K = 50), the Postprocessor greatly reduces the
racy and required training data size. In order to achieve false positives generated by the Outlier Detector while
the goals, we constructed different training data and test keeping the same detection rate. For the experiment in
data from each above dataset by means of randomly se- Union Mode, we got a similar conclusion (see Figure 6).
lecting sub-dataset with certain ratio of normal data to From the results of these experiments we can also con-
attack data, and then different experiments were carried clude that the proposed methods can keep good accuracy
out for each class which was regarded as an outlier or po- when automating the analysis process of locating the po-
tential interested instances by forensic investigators. The tential evidence, and the proposed method could be used
test datasets constructed for evaluating the performance in the practice of network forensic investigation.
of our proposed methods is described as follows: From all experiments, we also noted that when the pa-
rameter K is smaller, the false positives would become
• DS(r2l): DataSet(normal) ∪ DataSet(r2l); even worse than the results of the Outlier Detector. In
• DS(dos): DataSet(normal) ∪ DataSet(dos); order to further evaluate the impact of the parameter K
on the False Positive, we did a group of evaluating exper-
• DS(probe): DataSet(normal) ∪ DataSet(probe); iments with DS(dos), DS(probe), DS(r2l), DS(u2r) and
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 306

(a) Division Mode (b) Union Mode

Figure 4: Running mode of the postprocessor

1 1

0.9 0.9

0.8 0.8

0.7 0.7
Detection Rate
Detection Rate

0.6 0.6

0.5 0.5

0.4 0.4

Outlier Detector 0.3 Outlier Detector

0.3
Postprocessor(K=20) Postprocessor(K=20)
0.2 Postprocessor(K=50) 0.2 Postprocessor(K=50)
Postprocessor(K=100) Postprocessor(K=100)
0.1 0.1
0 0.2 0.4 0.6 0.8 1 1.2 1.4 0 0.2 0.4 0.6 0.8 1 1.2 1.4
False Positive Rate(%) False Positive Rate(%)

(a) ROC curves with DS(dos) (b) ROC curves with DS(probe)

1 1

0.9

0.8 0.8

0.7
Detection Rate

Detection Rate

0.6
0.6

0.5
0.4
0.4
Outlier Detector
0.3 Outlier Detector
0.2 Postprocessor(K=20)
Postprocessor(K=20)
Postprocessor(K=50)
0.2 Postprocessor(K=50)
Postprocessor(K=100) Postprocessor(K=100)
0.1 0
0 0.2 0.4 0.6 0.8 1 1.2 1.4 0 0.2 0.4 0.6 0.8 1 1.2 1.4
False Positive Rate(%) False Positive Rate(%)

(c) ROC curves with DS(r2l) (d) ROC curves with DS(u2r)

Figure 5: ROC curves in division mode

International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 307

5 Conclusions
1

Digital forensics presents a great number of new and in-

0.8 teresting challenges to computer security researchers. Es-
pecially the huge volume of data to be analyzed often
0.6
frustrated the forensic investigators. In the paper, we
Detection Rate

proposed the forensic framework to automate and speed

up the process of locating the potential evidence in the
0.4
network forensics, which based on the one-class SVM al-
Outlier Detector gorithm with a modified Gaussian (RBF) kernel to im-
0.2 Postprocessor(K=20)
plement a group of classification models to screen out the
Postprocessor(K=50)
Postprocessor(K=100) potential evidence. Besides this, we used a two-tier ap-
0 proach that combines outlier detection to reduce false neg-
0 0.2 0.4 0.6 0.8 1 1.2 1.4
False Positive Rate(%) ative rate with postprocessor to reduce false positive rate.
From the results obtained in these early experiments, we
believe that the proposed method has promise for the au-
Figure 6: ROC curves in union mode with DS(norm) tomation of digital forensic investigation.
Further experiments should be conducted with differ-
ent learning algorithms and paradigms to allow perfor-
mance comparisons with the proposed approach. Since
the Postprocessor still requires an investigator to supply
1.4 the training data or expert knowledge to build classifica-
DS(dos) tion model which increases the burden of the investiga-
DS(probe)
1.2
DS(r2l) tor, therefore we suggest that an effective unsupervised-
DS(u2r)
1 DS(norm)
learning method could be employed. This is one of our
False Positive Rate(%)

future goals.
0.8

0.6
References
0.4
[1] Be. E. Boser, I. Guyon, and V. Vapnik, “A training
0.2 algorithm for optimal margin classifiers,” Computa-
tional Learing Theory, pp. 144-152, 1992.
0
0 100 200 300 400 500 [2] C. Campbell and K. P. Bennett, “A linear program-
Value of Paramter K ming approach to novelty detection,” Advances in
Neural Information Processing Systems, vol. 14, pp.
Figure 7: Relation curves between parameter K and false 395-401, 2001.
positives [3] B. D. Carrier and E. H. Spfford, “Defining event
reconstruction of a digital crime scene,” Journal of
Forensic Sciences, vol. 49, no. 6, pp. 1291-1298, 2004.
[4] B. Carrier, File System Forensic Analysis, Addison
Wesley Professional, 2005.
[5] B. D. Carrier and E. H. Spafford, “Automated digital
DS(norm) datasets individually. The results of experi- evidence target definition using outlier analysis and
ments are presented in Figure 7 which shows the rela- existing evidence,” in 2005 Digital Forensic Research
tionship between the parameter K and the False Positive Workshop (DFRWS), 2005.
rate when the detection rate is a constant (90%). From [6] C. C. Chang and C. J. Lin, LIBSVM: A Li-
the Figure 7, we can draw the conclusion that the increase brary for Support Vector Machines, 2001.
of the parameter K will help decrease the False Positive ([Link] cjlin/libsvm)
at the very start, and this trend will tend to smooth with [7] M. Davy, A. Gretton, A. Doucet, and P. J. W. Rayne,
the increase of K. So we can conclude further that the pa- “Optimised support vector machines for nonstation-
rameter K should have an ideally critical value which will ary signal classification,” IEEE Signal Processing
benefit the decrease of the False Positive to a great de- Letters, vol. 9, pp. 442-445, 2002.
gree. In our experiments, the critical value of K is about [8] F. Desobry and M. Davy, “Support vector-based on-
100. The critical value of K depends on both the inter- line detection of abrupt changes,” in Proceedings of
ested type of event and the quality of training data. In ICASSP, vol. 4, pp. 872-875, 2003.
practice, the selection of K will become even worse, and [9] W. Lee and S. J. Stolfo. “Data mining approaches
how to determine the value of K will be a challenging for intrusion detection,” in Proceedings of the 7th
topic in theory. USENIX Security Symposium, pp. 79-93, 1998.
International Journal of Network Security, Vol.6, No.3, PP.301–308, May 2008 308

[10] S. Mukkamala and A. H. Sung, “Identifying signifi-

cant features for network forensic analysis using ar- Dongdai Lin is now a full time re-
tificial intelligent techniques,” International Journal search professor and deputy director
of Digital Evidence, vol. 1, no. 4, pp. 1-17, 2003. of State Key Labortory of Information
[11] F. Provost and T. Fawcett, “Robust classification for Security, Institute of Software of the
imprecise environments,” Machine Learning, vol. 42, Chinese Academy of Sciences. He re-
pp. 203-231, 2001. ceived his B.S. degree in mathemat-
[12] B. Schölkopf, J. C. Platt, J. Shawe-Taylor, A. J. ics from Shandong University in 1984,
Smola, and R. C. Williamson, “Estimating the sup- and the M.S. degree and Ph. D degree
port of a high-dimensional distribution,” Neural in coding theory and cryptology at Institute of Systems
Computation, vol. 13, no. 7, pp. 1443-1471, 2001. Science of the Chinese Academy of Sciences in 1987 and
[13] B. Schölkopf and A. J. Smola, Learning with Kernels: 1990 respectively. His current research interests include
Support Vector Machines, Regularization, Optimiza- cryptology, information security, grid computing, mathe-
tion, and Beyond MIT Press, Cambridge, MA, 2002. matics mechanization and symbolic computations.
[14] S. J. Stolfo, W. Fan, and W. Lee, “Cost-based model-
ing and evaluation for data mining with application Fengdeng Guo is now a full time re-
to fraud and intrusion detection: Results from the search professor and director of State
JAM projec”, in DARPA Information Survivability Key Labortory of Information Secu-
Conference, pp. 130-144, 2000. rity, Institute of Software of the Chi-
[15] D. R. Wilson, and T. R. Martinez, “Improved het- nese Academy of Sciences. His current
erogeneous distance functions,” Journal of Artificial research interests include cryptology,
Intelligence Research, no. 6, pp. 1-34, 1997. information security.

Zaiqiang Liu is now a Ph.D candi-

date at the State Key Laboratory of
Information Security, Institute of Soft-
ware, Chinese Academy of Sciences.
His research interests include Digital
Forensics and Network Security. E-
mail address: zaiqiangliu@[Link].