Charles Nicholas

University of Maryland, Baltimore County

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Trends

Author Order

Document Type

Co-Authors

Edward Raff

University of Maryland, Baltimore County

Maksim E. Eren

Los Alamos National Laboratory

Boian S. Alexandrov

Los Alamos National Laboratory

Manish Bhattarai

Los Alamos National Laboratory

R. Joyce

Booz Allen Hamilton (United States)

Ian Soboroff

National Institute of Standards and Technology

Cynthia Matuszek

University of Maryland, Baltimore County

Tim Finin

University of Maryland, Baltimore County

R. Scott Cost

Johns Hopkins University

Jacob Kogan

University of Maryland, Baltimore County

Cooperative Institutions

University of Maryland, Baltimore County

University of Maryland, College Park

University of Maryland, Baltimore

Purdue University West Lafayette

Los Alamos National Laboratory

Organizzazione Sociopsichiatrica Cantonale

University of Baltimore

Booz Allen Hamilton (United States)

Harvard University

Physical Sciences (United States)

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Field

SHOMAR: An Open Architecture for Distributed Intrusion Detection Services

J. Undercofer Filip Perich Charles Nicholas

Distributed Intrusion Detection Systems (DIDS) offer an alternative to centralized intrusion detection. Current research indicates that a distributed intrusion detection paradigm may afford greater coverage, consequently providing an increase in security. In some cases, DIDS offer an alternative to centralized analysis, consequently improving scalabity. SHOMAR, the distributed architecture presented in this paper, provides an open framework that enables secure access to heterogeneous software and hardware components of a distributed intrusion detection system. SHOMAR is built upon a simplified Public Key Infrastructure that provides for authentication, non-repudiation, anti-playback, and access control. This framework supports a broad spectrum of approaches, ranging from hierarchical to peer-to-peer. The system topology and rules governing access to intrusion detection services is based solely upon policy, which is enforced through the use of a capability manager. The protoype system uses Java. The Extensible Markup Language is the sole medium for data exchange between intrusion detection components. SHOMAR provides a distributed service infrastructure independent of the underlying communications network.

Source

Cite

Citations (6)

Collaborative filtering and the generalized vector space model (poster session)

Ian Soboroff Charles Nicholas

Collaborative filtering is a technique for recommending documents to users based on how similar their tastes are to other users. If two users tend to agree on what they like, the system will recommend the same documents to them. The generalized vector space model of information retrieval represents a document by a vector of its similarities to all other documents. The process of collaborative filtering is nearly identical to the process of retrieval using GVSM in a matrix of user ratings. Using this observation, a model for filtering collaboratively using document content is possible.

Vector space model

10.1145/345508.345646

Cite

Citations (29)

Malware Detection by Eating a Whole EXE

arXiv (Cornell University) (2017)

Edward Raff Jon Barker Jared Sylvester Robert N. Brandon Bryan Catanzaro

In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community. Building a neural network for such a problem presents a number of interesting challenges that have not occurred in tasks such as image processing or NLP. In particular, we note that detection from raw bytes presents a sequence problem with over two million time steps and a problem where batch normalization appear to hinder the learning process. We present our initial work in building a solution to tackle this problem, which has linear complexity dependence on the sequence length, and allows for interpretable sub-regions of the binary to be identified. In doing so we will discuss the many challenges in building a neural network to process data at this scale, and the methods we used to work around them.

Normalization

Upload

Sequence (biology)

Snapshot (computer storage)

Source

Cite

Citations (65)

Grouping Multidimensional Data: Recent Advances in Clustering

Springer eBooks (2006)

Jacob Kogan Charles Nicholas Marc Teboulle

Data pre-processing

Clustering high-dimensional data

Source

Cite

Citations (134)

An investigation of byte n-gram features for malware classification

Journal of Computer Virology and Hacking Techniques (2016)

Edward Raff Richard Zak Russell Cox Jared Sylvester Paul Yacci

Executable

Overfitting

n-gram

Regularization

Binary classification

10.1007/s11416-016-0283-1

Cite

Citations (147)

Agent development support for Tcl

R. Scott Cost Ian Soboroff Jeegar Lakhani Tim Finin Ethan L. Miller

In the past few years, the explosive growth of the Internet has allowed the construction of virtual systems containing hundreds or thousands of individual, relatively inexpensive computers. The agent paradigm is well-suited for this environment because it is based on distributed autonomous computation. Although the definition of a software agent varies widely, some common features are present in most definitions of agents. Agents should be autonomous, operating independently of their creator(s). Agents should have the ability to move freely about the Internet. Agents should be able to adapt readily to new information and changes in their environment. Finally, agents should be able to communicate at a high level, in order to facilitate coordination and co-operation among groups of agents. These aspects of agency provide a dynamic framework for the design of distributed systems.

Autonomous agent

Software agent

Source

Cite

Citations (3)

Lempel-Ziv Jaccard Distance, an effective alternative to ssdeep and sdhash

Digital Investigation (2018)

Edward Raff Charles Nicholas

Jaccard index

10.1016/j.diin.2017.12.004

Cite

Citations (20)

Machine Learning for Malware Detection

WORLD SCIENTIFIC eBooks (2022)

Edward Raff Charles Nicholas

10.1142/13017

Cite

Citations (2)

Data Mining - Text mining with information-theoretic clustering

Computing in Science & Engineering (2003)

J. Kogan Charles Nicholas V. �. Vol'kovich

Motivated by the success of hybrid information-retrieval algorithms, the authors report on the development of their hybrid clustering scheme. Scheme experiments on data in a reduced vector space model indicate a higher performance level over several existing clustering algorithms.

Affinity propagation

10.1109/mcise.2003.1238704

Cite

Citations (24)

ITtalks: a case study in the Semantic Web and DAML+OIL

IEEE Intelligent Systems (2002)

R. Scott Cost Tim Finin Anupam Joshi Yun Peng Charles Nicholas

Semantic Web markup languages will improve the automated gathering and processing of information and help integrate multiagent systems with the existing information infrastructure. The authors, describe their ITtalks system and discuss how Semantic Web concepts and DAML+OIL extend its ability to provide an intelligent online service.

10.1109/5254.988447

Cite

Citations (81)