Abstract:Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

HMMs (Hidden Markov models) based on anomaly intrusion detection method

Survey on HMM based anomaly intrusion detection using system calls

Modeling program behaviors by hidden Markov models for intrusion detection

Anomaly detection method based on HMMs using system call and call stack information

Hidden Semi-Markov Model for Anomaly Detection

Anomaly Detection Technique Based on Hidden Markov Model

Packet Payload Based Anomalous Network Intrusion Detection

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

Anomaly detection based on grammar

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

Intrusion Detection Method Based on Two-Layer HMM

A Method for HMM-based System Calls Intrusion Detection Based on Hybrid Training Algorithm

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns

HMM Algorithm Base on Clustering and Application in NIDS

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

A New Anomaly Detection Method Based on Rough Set Reduction and HMM

An Unsupervised Anomaly Detection Approach Using Subtractive Clustering And Hidden Markov Model

An Anomaly Detection System Based on a Hidden Semi-Markov Model

A Dynamic Anomaly Detection Model for Web User Behavior Based on HsMM

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection