Abstract:Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

Hierarchical Behavioral Model for Automatic Runtime Anomaly Detection

Anomaly detection based on grammar

Accurate Efficient Program Behavior-based Anomaly Detection Model

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns

Intention-based Behavioral Anomaly Detection

A Runtime Approach for Software Fault Analysis Based on Interpolation

Execution Anomaly Detection in Large-Scale Systems Through Console Log Analysis

An Investigation of the Monitoring Activity in Self Adaptive Systems

CL-MMAD: A Contrastive Learning Based Multimodal Software Runtime Anomaly Detection Method

An Unsupervised Spatiotemporal Graphical Modeling Approach to Anomaly Detection in Distributed CPS

Detecting Data-Model-Oriented Anomalies In Parallel Business Process

Anomaly Detection in Hierarchical Data Streams under Unknown Models

Software Monitoring Through Formal Specification Animation

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Statistical Model-based Abnormal Behavior Detection

Anomaly Detection of User Behavior Based on DTMC with States of Variable-Length Sequences

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

Hidden Semi-Markov Model for Anomaly Detection

Anomaly Detection through Spatio-temporal Context Modeling in Crowded Scenes

Behavior-Based Proactive Detection of Unknown Malicious Codes