Materials to form topics for S-38.4030 Postgraduate Course on Networking Technology

General instructions

Avoid overlap

Course personnel acknowledges that students taking this course probably do not initially know that much about anomaly detection systems. Be that as it may, we do not wish to see all presentations beginning with "a quick 15-slide introduction to anomaly detection systems". We will expect that a couple of the course participants will make it their task to present the introduction to anomaly detection systems and then we'll assume that everyone else knows the basics.

Work together, form networks with colleagues

To avoid unnnecessary overlap every participant should know what others are doing. Communicate, participate, contribute and educate your fellow students so that you all know what you are doing and you may avoid overlap in content.

Tentative list of materials

Each participant will choose/suggest a topic based on his/her interests and the list of materials below. The participant may also reserve/suggest his/her own presentation topic together with a list of materials. In general, a good topic for this course will have roughly 6-10 papers as its basis, 2-3 of them from the lists below. Final assignment of topics will be organized on the first meeting of the seminar.

Below you'll find works and material that deal with anomaly detection. The classification to architectures, systems and methods is somewhat ambiguous and overlaps exist. Expect updates! We also strongly encourage the student to do their own searches on their chosen topic area.

Material is downloadable only within hut.fi or tkk.fi domains!!

General issues and IDS-systems

At least the following points should be considered in the paper&presentation: What is intrusion detection, how does it relate to other areas of network security? What are the different approaches to intrusion detection? How do the different approaches differ from and resemble each other? Are there any common properties between approaches?

Possible topics

What is anomaly detection?
Different anomaly types and how are they detected in a network. (Taxonomy for anomalies)
...

Anomaly detection-architectures

At least the following points should be considered in the paper&presentation: Do different architectures share similarities? In regards to the traffic process, when is AD applied? How do different networks differ from the viewpoint of AD? How are they the same? Can you form a model on which you could implement an AD-system? Analyze the strengths and weaknesses of the presented solutions.

AD-methods

At least the following points should be considered in the paper&presentation: What area/type of mathematics and/or statistical analysis is used? Explain what is monitored and how the monitoring results are analysed? How are the analysis results fed into the method? Computationally, how expensive (heavy) is the method? Is the method intended to be real-time? How quickly will it react to anomalies/intrusion attempts? Is the presented method feasible, realistic? Analyze the strengths and weaknesses of the presented methods.