Abstract:Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

Markov Chain Intrusion Detection Model Based on System Call Macro

A Two-Layer Markov Chain Anomaly Detection Model

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

Intrusion Detection Based on System Calls and Call Stack Log

Anomaly detection method based on HMMs using system call and call stack information

Novel Method for Anomaly Detection of User Behavior Based on Shell Commands and DTMC Models

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

Intrusion Detection Method Based on Two-Layer HMM

Multi-agent based hybrid Intrusion detection system

Back-propagation Neural Network on Markov Chains from System Call Sequences: a New Approach for Detecting Android Malware with System Call Sequences.

Robust Algorithm for Attack Detection Based on Time‐varying Hidden Markov Model Subject to Outliers

Modeling program behaviors by hidden Markov models for intrusion detection

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns

A Multi-Module Anomaly Detection Scheme Based on System Call Prediction

Anomaly Detection of User Behavior Based on DTMC with States of Variable-Length Sequences

Intrusion Detection Based on the Short Sequence Model

Masquerade Detection Based on Shell Commands and High-Order Markov Chain Models

Anomaly based multi-stage attack detection method

Hidden Semi-Markov Model for Anomaly Detection