Abstract:Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

A Dynamic Anomaly Detection Model for Web User Behavior Based on HsMM

Anomaly Detection Based on Web Users' Browsing Behaviors

Categorization Of Web Pages Based On Hsmm For Detecting Ddos Attacks

A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors

An Anomaly Detection System Based on a Hidden Semi-Markov Model

Hidden Semi-Markov Model for Anomaly Detection

Detecting Network-Wide Traffic Anomalies Based on Spatial HMM

A Network-wide Traffic Anomaly Detection Method Based on HSMM

DDos attacks detection for flash crowds of high-volume website

A Novel Model for Detecting Application Layer DDoS Attacks

Anomaly Detection on Collective Moving Patterns: A Hidden Markov Model Based Solution.

User Profiling for Intrusion Detection Using Dynamic and Static Behavioral Models

A simple method for unsupervised anomaly detection: An application to Web time series data

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

Detecting Anomalous Behavior in Cloud Servers by Nested-Arc Hidden SEMI-Markov Model with State Summarization

Dynamic mining for web navigation patterns based on markov model

Anomaly Detection of User Behavior Based on DTMC with States of Variable-Length Sequences

Light-weight detection of HTTP attacks for large-scale Web sites

AnomalyDetect: An Online Distance-Based Anomaly Detection Algorithm

A New Anomaly Detection Method Based on Rough Set Reduction and HMM