Abstract:Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

Modeling program behaviors by hidden Markov models for intrusion detection

A Hidden Markov Models-Based Anomaly Intrusion Detection Method

Hidden markov model based intrusion detection

Intrusion Detection Based On Hidden Markov Model

The prediction role of hidden Markov model in intrusion detection

HMMs (Hidden Markov models) based on anomaly intrusion detection method

HMMs for anomaly intrusion detection

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

A HMM-based Method for Anomaly Detection

Hidden Semi-Markov Model for Anomaly Detection

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

Intrusion Detection Method Based on Two-Layer HMM

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

Software Abnormal Behavior Detection Based on Hidden Markov Model

A Method for HMM-based System Calls Intrusion Detection Based on Hybrid Training Algorithm

Method for anomaly detection of user behaviors based on hidden Markov models

Anomaly detection method based on HMMs using system call and call stack information

A Hidden Markov Model Based Framework for Tracking and Predicting of Attack Intention

Application of Hidden Markov Model in SQL Injection Detection

Applications of HMM in Protocol Anomaly Detection

Survey on HMM based anomaly intrusion detection using system calls