Abstract:Due to the rapid and continuous increase of network intrusion, the need of protecting our systems becomes more and more compelling. In many situations, there exists a weak anomaly signal detection problem: due to the little number of anomalous system calls, the anomalous patterns of some intrusions may not be enough to distinguish themselves from normal activities so the existing anomaly detection systems can not detect this kind of sequences accurately. Motivated by this, we propose a multi-module anomaly detection scheme to solve this problem through utilizing system call prediction to enlarge the patterns of weak anomaly signal sequences and make them more distinguishable. Besides this, a variation of the Viterbi algorithm (called VV algorithm) is developed to predict the most probable future system calls more efficiently and a Markov-based intrusion detection method is adopted for the pattern value calculation and anomaly detection. The results of our experimental study conclude the followings: (i) the proposed scheme can greatly improve the intrusion detection accuracy of this Markov-based intrusion detection method in terms of hit rates under small false alarm rate bounds; (ii) the performance of the proposed scheme depends on the prediction accuracy of the adopted prediction technique; (iii) the developed VV algorithm is exponentially more efficient than a baseline method.

Intrusion Detection Using Variable-length System Calls Patterns

An Intrusion Detection System Based On System Call

Intrusion Detection Based on System Calls and Call Stack Log

Intrusion Detection Method Based on Two-Layer HMM

Intrusion Detection Based on the Short Sequence Model

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

Intrusion Detection Models Based on Data Mining

Variable Length Pattern Matching for Hardware Network Intrusion Detection System

Design and Implementation of Intrusion Detection System Based on System-Call

Predicting the Intrusion Intentions by Observing System Call Sequences

A Multi-Module Anomaly Detection Scheme Based on System Call Prediction

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Anomaly Intrusion Detection Based on System Call

Error-tolerant multi-pattern matching algorithms for intrusion detection

An integrated pattern recognition approach for intrusion detection

Improvement on Anomaly Intrusion Detection Algorithm Based on V-Gram

Low-cost Intrusion Detection Method Based on Statistical Language Models

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Implementation Of Sequence Patterns Mining In Network Intrusion Detection System

Intrusion Detection at Scale with the Assistance of a Command-line Language Model