@conference {
	title = {A Unified Framework of Information Assurance for the Design and Analysis fo Security Algorithms},
	author = {Cardenas, Alvaro A., Taban, Gelareh., Baras, John S.},
	year = {2006},
	month = {11/2006},
	abstract = {Most information security algorithms cannot achieve perfect security without incurring severe operational costs such as false alarms, network congestion, capital investment etc. Operating or designing an algorithm with perfect security is therefore not an economically rational alternative and thus the question arises of how to find the appropriate tradeoff between security and its costs. Although several other researchers have recognized that there is a tradeoff, there is very little work in formally characterizing it. This paper provides the first steps towards a more systematic and general approach for cost-effective security management.},
	address = {Orlando, FL},
	booktitle = {25th Army Science Conference},
	pages = {pp. 1-8}
}
@conference {
	title = {B-ROC Curves for the Assessment of Classifiers over Imbalanced Data Sets},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {The class imbalance problem appears to be ubiquitous to a large portion of the machine learning and data mining communities. One of the key questions in this setting is how to evaluate the learning algorithms in the case of class imbalances. In this paper we introduce the Bayesian Receiver Operating Characteristic (B-ROC) curves, as a set of tradeoff curves that combine in an intuitive way, the variables that are more relevant to the evaluation of classifiers over imbalanced data sets. This presentation is based on section 4 of (C{\textasciiacute}ardenas, Baras, \&amp; Seamon 2006).},
	address = {Boston, Massachusetts},
	booktitle = {21st National Conference on Artificial Intelligence, (AAAI 06) Nectar track,},
	pages = {pp. 1581-1584}
}
@conference {
	title = {Evaluation of Classifiers Practical Considerations for Security Applications},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {In recent years several tools based on statistical methods and machine learning have been incorporated in security related tasks involving classification, such as intrusion detection systems (IDSs), fraud detection, spam filters, biometrics and multimedia forensics. Measuring the security performance of these classifiers is an essential part for facilitating decision making, determining the viability of the product, or for comparing multiple classifiers. There are however relevant considerations for security related problems that are sometimes ignored by traditional evaluation schemes. In this paper we identify two pervasive problems in securityrelated applications. The first problem is the usually large class imbalance between normal events and attack events. This problem has been addressed by evaluating classifiers based on cost-sensitive metrics and with the introduction of Bayesian Receiver Operating Characteristic (B-ROC) curves. The second problem to consider is the fact that the classifier or learning rule will be deployed in an adversarial environment. This implies that good performance on average might not be a good performance measure, but rather we look for good performance under the worst type of adversarial attacks. In order to address this notion more precisely we provide a framework to model an adversary and define security notions based on evaluation metrics},
	address = {Boston, MA},
	booktitle = {AAAI Workshop on Evaluation Methods for Machine Learning}
}
@conference {
	title = {Evaluation of Classifiers: Practical Considerations for Security Applications},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {In recent years several tools based on statistical methods and machine learning have been incorporated in security related tasks involving classification, such as intrusion detection systems (IDSs), fraud detection, spam filters, biometrics and multimedia forensics. Measuring the security performance of these classifiers is an essential part for facilitating decision making, determining the viability of the product, or for comparing multiple classifiers. There are however relevant considerations for security related problems that are sometimes ignored by traditional evaluation schemes. In this paper we identify two pervasive problems in security related applications. The first problem is the usually large class imbalance between normal events and attack events. This problem has been addressed by evaluating classifiers based on cost-sensitive metrics and with the introduction of Bayesian Receiver Operating Characteristic (B-ROC) curves. The second problem to consider is the fact that the classifier or learning rule will be deployed in an adversarial environment. This implies that good performance on average might not be a good performance measure, but rather we look for good performance under the worst type of adversarial attacks. In order to address this notion more precisely we provide a framework to model an adversary and define security notions based on evaluation metrics.},
	address = {Boston, Massachusetts},
	booktitle = {AAAI Workshop on Evaluation Methods for Machine Learning}
}
@conference {
	title = {A Framework for the Evaluation of Intrusion Detection Systems},
	author = {Cardenas, Alvaro A., Baras, John S., Seamon, Karl.},
	year = {2006},
	month = {05/2006},
	abstract = {Classification accuracy in intrusion detection systems (IDSs) deals with such fundamental problems as how to compare two or more IDSs, how to evaluate the performance of an IDS, and how to determine the best configuration of the IDS. In an effort to analyze and solve these related problems, evaluation metrics such as the Bayesian detection rate, the expected cost, the sensitivity and the intrusion detection capability have been introduced. In this paper, we study the advantages and disadvantages of each of these performance metrics and analyze them in a unified framework. Additionally, we introduce the intrusion detection operating characteristic (IDOC) curves as a new IDS performance tradeoff which combines in an intuitive way the variables that are more relevant to the intrusion detection evaluation problem. We also introduce a formal framework for reasoning about the performance of an IDS and the proposed metrics against adaptive adversaries. We provide simulations and experimental results to illustrate the benefits of the proposed framework.},
	address = {Oakland, California},
	booktitle = {2006 IEEE Symposium on Security and Privacy}
}
