Abstract:Intrusion detection is an important technique in the defense-in-depth network security framework. In recent years, it has been a widely studied topic in computer network security. In this paper, we present two methods, namely, the Hidden Markov Models (HMM) method and the Self Organizing Maps (SOM) method, to profile normal program behavior for anomaly intrusion detection based on computer audit data. The HMM method utilizes the transition property of events while SOM method relies on the frequency property of events. Two data sets, CERT synthetic Sendmail system call data collected in the University of New Mexico (UNM) and Live FTP system call data collected in the CNSIS lab of Xi'an Jiaotong University, were used to assess the two methods. Testing results show that the HMM method using the transition property of events produces good detection performance while high computational expense is required both for training and detection. The HMM method is better than other two methods reported previously in terms of detection accuracy for the same data set. The SOM method considering the frequency property of events, on the other hand, is suitable for real-time intrusion detection because of its capability of processing a large amount of data with low computational overhead.

Intrusion Detection Based on System Calls and Call Stack Log

An Intrusion Detection System Based On System Call

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

Intrusion Detection And Simulation For High-Speed Networks

Multi-agent based hybrid Intrusion detection system

Anomaly detection based on grammar

Markov Chain Intrusion Detection Model Based on System Call Macro

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Low-cost Intrusion Detection Method Based on Statistical Language Models

Efficient Intrusion Detection Based on Static Analysis and Stack Walks

An integrated pattern recognition approach for intrusion detection

Predicting the Intrusion Intentions by Observing System Call Sequences

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

Modeling program behaviors by hidden Markov models for intrusion detection

Program Intrusion Detection Based on Simplified Control Flow Monitoring

Study on Abnormal Detection Based on System Call and Data Mining Technique

A Novel Intrusion Detection Method Based on Principle Component Analysis in Computer Security

Smart Intrusion Detection Method Using Negative Selection Algorithm Based on Maximum Entropy Model

Study of Intrusion Detecton Mondels for Web Applications

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data