Study on Abnormal Detection Based on System Call and Data Mining Technique

ZHAO Yu-ming,ZHANG Wei,teng SH

2007-01-01

Abstract:The technique of intrusion detection has become a focus in the field ofnetwork security. This paper introduced the categories of intrusion detection and the methods of data mining applied in abnormal detection. It also described the design and implementation of the abnormal IDS based on system call and data mining algorithms.

What problem does this paper attempt to address?

Study of Adaptive Intrusion Detection with Data Mining

Fang Jinhe,Feng Yan,Wang Ruijie

DOI: https://doi.org/10.3321/j.issn:1002-8331.2006.18.048

2006-01-01

Abstract:After discussing the constraints of current intrusion detection systems(IDS),we issue two problems should be considered in developing an adaptive IDS,one is to select the time to update the normal profile and the other is to select a mechanism to update the profile.To resolve the first problem,we calculate the similarity between the incremental audit data and the normal profile and then decide whether to and when to update the profile.To resolve the second problem,we employ a sliding window approach and use only the audit data inside that sliding window to update the profile.The window therefore acts to filter out outdated audit data and to build a profile based on only recent data that reflects the recent system activities.
An Intrusion Detection System Based On System Call

Yue Shen,Fei Yu,Ling-Fen Zhang,Ji-Yao An,Miao-Liang Zhu

DOI: https://doi.org/10.1109/CANET.2005.1598184

2005-01-01

Abstract:Intrusion detection is an efficient way to protect information system. This paper puts forward a new method of anomalous intrusion detection based on system call. It uses system calls regarded as input, and creates a FSA for the functions in the program. Then the FSA is used to detect the attack. Moreover, It can find the place of the vulnerability which exists in the program. This can help to alter the source program. Results are shown that this method is effective for some intrusion events.
Research on Data Mining-based Intrusion Detection in Real-time Environment

胡敏,潘雪增,平玲娣

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.01.033

2004-01-01

Abstract:This paper focuses on issures related to deploying a data mining-based IDS (Intrusion Detection System) in a real time environment To overcome the limitations of traditional IDS, the corresponding solutions to accurracy, efficiency and usability is presented.These solutions impove efficiency of traditional DOS and maintain a desired accuracy level. This paper also proposed an architecture consisting of sensors, detectors, a data warehouse and model generation components. This architecture facilitates the sharing and storage of audit data and the distribution of new or updated models. Also, it improves the efficiency and scalability of the traditional IDS.
Design and Implementation of Intrusion Detection System Based on System-Call

ZHANG Jun,SU Pu-rui,FENG Deng-guo

2006-01-01

Journal of Computer Applications

Abstract:The technology of Intrusion Detection is one of the important measures to protect the networks.Host-based intrusion detection is used to protect the key hosts.A flexible loading intrusion detection based on system-call was introduced in this paper.This system improved the common data collection method,and adopted virtual equipment driversto acquire system call.This method brings small influence on system,is easy to load and unload,and provides the standard interface. The data analysis integrates the two detection methods: anomaly and misuse,which provides corresponding detection models and introduces the noise filtering function.
Abnormal Detection Research Based on Outlier Mining

Lei Zhang,Changjiang Liu,Yong Chen,Shaowen Lao

DOI: https://doi.org/10.1109/ICICTA.2018.00009

2018-01-01

Abstract:This paper introduces the latest development of intrusion detection based on data mining, and studies the key technologies of network intrusion detection based on data mining, especially outlier mining. A anomaly detection model based on outlier mining is proposed. The model firstly preprocesses the data and sets the normal sample set, calculates the outlier score of each sample in the normal sample set, and combines it with the specified outlier value threshold. The normal behavior profile is formed, which can be used as the basis for detection.
Research of Anomaly Detection System Based on Data Mining

吕志军,袁卫忠,仲海骏,黄皓,曾庆凯,谢立

DOI: https://doi.org/10.3969/j.issn.1002-137x.2004.10.015

2004-01-01

Computer Science

Abstract:Intrusion detection system(IDS)must be capable of detecting new and unknown attacks. In this paper, we propose an Anomaly Detection System based on Data Mining(ADESDM). Firstly, ADESDM mine suspicious behaviors in the protocol header, ports and application data with strong association rules and weak association rules; then, it sends the suspicious behaviors to the Deciding Module based on Bayesian Belief Net (DMBBN). In real network communications, the attributes, such as time, direction, ports and IP addresses, are influencing each other. The DMBBN illustrates the conditional probabilities and relationship among the above attributes, and uses them to determine whether the suspicious behaviors are normal ones or attacks. Thus, system can reduce the false alarm rate.
Detection Approach for Malicious Behaviors Based on Data Mining

Cai Wan

2003-01-01

Computer Science

Abstract:Intrusion Detection System (IDS) is an important network security technique. It can dynamic detect the network attack behaviors. At present, great issues for IDS are incapable of detecting the unknown malicious attack behaviors. So that, some new detection techniques are presented,data mining-based detection technique is an effective method in them. In this paper, data mining-based detection method and its key techniques are discussed in detail.
Design of the Abnormity Detection Model Based on Data Mining Technology

Lü Hong-zhu,ZHANG Jian-ping,DENG Wen-xin

DOI: https://doi.org/10.3969/j.issn.1007-9831.2007.06.011

2007-01-01

Abstract:The body under study is the technology of data mining.However,the intrusion model of the current IDS can't reflect the intrusion characteristics well,a new model of the abnormity detection model with the application of DM technology was given and the abnormity detection model of design process.
Anomaly Network Intrusion Detection System Based on Data Mining

宋世杰,胡华平,胡笑蕾,金士尧

2003-01-01

Abstract:The key issue of anomaly NIDS is building normal patterns, comparing current system or user behaviors with history behaviors, and then detecting intrusion. We introduced some data mining algorithms, presentd a classification method of IDS based on data mining, and described the process of data mining application in anomaly NIDS from network layer and application layer. We proposed three methods of pattern comparison in detail, and verified that the obtained normal audit data is enough for network layer anomaly NIDS.'
Hybrid Intrusion Detection Based on Data Mining

Lei Zhang,Jianqing Zhang,Yong Chen,Shaowen Liao

DOI: https://doi.org/10.1109/icicta.2018.00074

2018-01-01

Abstract:In this paper, a hybrid intrusion detection model based on data mining, which is commonly used in network security anomaly detection, is proposed that combines anomaly detection with misuse detection technology. Two test stages were formed and applied to the instrusion detection system in the process of large-scale network traffic detection. On the basis of improving the detection ability of the massive information detection system, the security of the data source of the intrusion detection system was ensured.
Anomaly Intrusion Detection Based on System Call

Haojin Zhu

2007-01-01

Abstract:Monitoring program behavior is one of the highlighted research topics of host-based anomaly detection recently.The key is to construct a program behavior-based anomaly detection model.Some existing anomaly detection techniques based on system call sequences are analyzed and discussed in this paper.They are compared from three dimensions: the information extracted from system call,the system call level used in anomaly detection and the information recorded by anomaly detector.Future work in this direction is also presented.
Research on Network Intrusion Detection Based on Data Mining

杨建华,蒋玉明,彭轮

DOI: https://doi.org/10.3969/j.issn.1008-0570.2009.24.011

2009-01-01

Abstract:In this paper an intrusion detection system based on data mining is proposed,and its main idea is to apply data mining methods to learn rules that can capture normal and intrusion activities from pre-processed audit data that contain network connection information. Put forward a method to improve the Apriori algorithm,whose I/O is quite surprising when scanning the database. To improve the method is feasible;the normal rules in the knowledge database in IDS are mined. And the experiment indicates that the model can produce new rules,which approve the validity and the feasibility of the IDS.
Applications of data mining to network intrusion detection

ZHANG Jin-rong,LIU Feng,ZHAO Zhi-hong,LUO Bin

DOI: https://doi.org/10.16208/j.issn1000-7024.2009.24.052

2009-01-01

Abstract:There are many problems such as poor adaptability,limited extensibility and experts hand-coding in traditional intrusion detection systems.Data mining-based intrusion detection techniques can extract knowledge and patterns of abnormal intrusions and normal user profiles from training data automatically,hence resolving the problems of tradition IDS properly.Main applications of data mining to network intrusion detection are surveied,i.e.clustering analysis,classification analysis,association rule analysis and sequential patterns analysis.Basic principles of each as well as latest research and improvements.At last,a summary of existing problems and future research directions is given.
PRACTICAL NETWORK ANOMALY DETECTION USING DATA MINING TECHNIQUES

Xiejun Ni,Daojing He,Farooq Ahmad

DOI: https://doi.org/10.21015/vtse.v9i2.403

2016-01-01

VFAST Transactions on Software Engineering

Abstract:Revised July 2015 ABSTRACT. Network anomaly detection is an effective way to detect intrusions which defends our computer systems or network from attackers on the Internet. In this paper, we introduce the current research works in network anomaly detection and consider several pratical solutions for this issue. Different from signature-based method, data mining techniques can automatically extract normal pattern from a large set of network data and distinguish them from each other. However, those data mining techniques, such as classification, clustering, association rules and feature selection, can not be applied into this problem directly due to the characteristic of network data and technique themselves. We analyze those unfitness and propose some adaptation to detect anomaly timely and accurately.
Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Jiang Shan,Chen Changai

DOI: https://doi.org/10.2991/isrme-15.2015.109

2015-01-01

Abstract:The security of software applications, from web-based applications to mobile services, is always at risk because of the open society of internet. With the increase in the number of network throughput and security threats, intrusion detection system has attracted much attention in recent years. In this paper, we undertake the research on the principle techniques for network intrusion detection based on data mining and analysis approach. We adopt the prior knowledge on Bayesian network which is a directed acyclic graph, each node represents a random variable and an edge said direct probabilistic dependencies between two connected nodes. Then, we use the traditional risk assessment model to measure the possibility of being hearted. The numeric analysis and experimental illustration indicates the effectiveness of our method compared with other popular adopted state-of-the-art methodologies. In the future, we plan to introduce the graph and complex network theory into our prototype system to enhance the performance.
Techniques of IDS Based on Anomaly Detection

胡亮,金刚,于漫,任斐,任维武

DOI: https://doi.org/10.3321/j.issn:1671-5489.2009.06.032

2009-01-01

Abstract:The authors provided a comprehensive survey of anomaly detection systems used in the recent years.Intrusion detection was divided into 3 kinds based on technologies used.They are statistical anomaly detection,machine learning based anomaly detection and data mining based anomaly detection.The authors described the various features of anomaly detection technologies in details,represented the algorithms used in the current Anomaly Intrusion Detection Systems,the implements of the algorithms,and also compared the effects of various detection algorithms through the experiment.
Intrusion Detection Models Based on Data Mining

Guojun Mao,Xindong Wu,Xuxian Jiang

DOI: https://doi.org/10.1080/18756891.2012.670519

2012-01-01

Abstract:Computer intrusions are taking place everywhere, and have become a major concern for information security. Most intrusions to a computer system may result from illegitimate or irregular calls to the operating system, so analyzing the system-call sequences becomes an important and fundamental technique to detect potential intrusions. This paper proposes two models based on data mining technology, respectively called frequency patterns (FP) and tree patterns (TP) for intrusion detection. FP employs a typical method of sequential mining based on frequency analysis, and uses a short sequence model to find out quickly frequent sequential patterns in the training system-call sequences. TP makes use of the technique of tree pattern mining, and can get a quality profile from the training system-call sequences of a given system. Experimental results show that FP has good performances in training and detecting intrusions from short system-call sequences, and TP can achieve a high detection precision in handling long sequences.
Design and Implementation of the Adaptive Intrusion Detection Framework Based on Data Mining

Liu Yongjian,Xu Xin,Wang Zhenghua,Xue Changxin

DOI: https://doi.org/10.3321/j.issn:1002-8331.2006.14.047

2006-01-01

Abstract:The widely use of data mining,artificial neural network and machine learning in the intrusion detection has greatly improved the precision of the detection engine.However,the missed alarms in the misuse detection and the false alarms in the anomaly detection are still big problems.This paper combines the advantages of the misuse detection and the anomaly detection,integrates the idea of machine learning,designs and implements a novel compound intrusion detection system with self-adaptive ability.
A Data Mining Based Intrusion Detection Model

Jh Sun,H Jin,H Chen,Zf Han,Dq Zou

DOI: https://doi.org/10.1007/978-3-540-45080-1_91

2003-01-01

Abstract:Intrusion Detection Systems (IDSs) have become a critical part of security systems. The goal of an intrusion detection system is to block intrusion effectively and accurately. However, the performance of IDS is not satisfying. In this paper, we study the issue of building a data mining based intrusion detection model to raise the detection performance. The key ideas are to use data mining techniques to discover consistent and useful patterns for intrusion and use the set of patterns to recognize intrusion. By applying statistics inference theory to this model, the patterns mined from a set of test data are effective to detect the attacks in the same category, and therefore can detect most novel attacks that are variants of known attacks.
Technique of Anomaly Intrusion Detection Based on Neural Network and System Calls

ZHANG Yi-rong,XIAN Ming,XIAO Shun-ping,WANG Guo-yu

DOI: https://doi.org/10.3969/j.issn.1001-3695.2006.09.038

2006-01-01

Abstract:The paper presents an idea of profiling normal processes according to multi-layer BP(Back Propagation) neural network.The experiment result in the 1998 DARPA intrusion detection evaluation data set and the performance comparison with K-Nearest neighbor classifier and time-delay embedding with(frequency) threshold(stide) algorithms show that the proposed algorithm achieves a high detection rate under a quite low false positive rate.

Study on Abnormal Detection Based on System Call and Data Mining Technique

Study of Adaptive Intrusion Detection with Data Mining

An Intrusion Detection System Based On System Call

Research on Data Mining-based Intrusion Detection in Real-time Environment

Design and Implementation of Intrusion Detection System Based on System-Call

Abnormal Detection Research Based on Outlier Mining

Research of Anomaly Detection System Based on Data Mining

Detection Approach for Malicious Behaviors Based on Data Mining

Design of the Abnormity Detection Model Based on Data Mining Technology

Anomaly Network Intrusion Detection System Based on Data Mining

Hybrid Intrusion Detection Based on Data Mining

Anomaly Intrusion Detection Based on System Call

Research on Network Intrusion Detection Based on Data Mining

Applications of data mining to network intrusion detection

PRACTICAL NETWORK ANOMALY DETECTION USING DATA MINING TECHNIQUES

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Techniques of IDS Based on Anomaly Detection

Intrusion Detection Models Based on Data Mining

Design and Implementation of the Adaptive Intrusion Detection Framework Based on Data Mining

A Data Mining Based Intrusion Detection Model

Technique of Anomaly Intrusion Detection Based on Neural Network and System Calls