Network intrusion detection based on system calls and data mining

Authors:
Xinguang Tian;Xueqi Cheng;Miyi Duan;Rui Liao;Hong Chen;Xiaojuan Chen
Affiliations:
Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China 100080;Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China 100080;Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China 100080 and Institute of Computing Technology, Beijing Jiaotong University, Beijing, China 100029;Institute of Computing Technology, Beijing Jiaotong University, Beijing, China 100029;Zhengzhou Information Science and Technology Institute, Zhengzhou, China 450004;College of Computer and Information Engineering, Beijing Technology and Business University, Beijing, China 100037
Venue:
Frontiers of Computer Science in China
Year:
2010

Citing 6
Cited 0

An Empirical Study of Two Approaches to Sequence Learning for Anomaly Detection

Machine Learning
Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection

IEEE Transactions on Computers
Information-Theoretic Measures for Anomaly Detection

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Intrusion detection using an ensemble of intelligent paradigms

Journal of Network and Computer Applications - Special issue on computational intelligence on the internet
Intrusion detection using sequences of system calls

Journal of Computer Security
Intrusion detection techniques and approaches

Computer Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Anomaly intrusion detection is currently an active research topic in the field of network security. This paper proposes a novel method for detecting anomalous program behavior, which is applicable to host-based intrusion detection systems monitoring system call activities. The method employs data mining techniques to model the normal behavior of a privileged program, and extracts normal system call sequences according to their supports and confidences in the training data. At the detection stage, a fixed-length sequence pattern matching algorithm is utilized to perform the comparison of the current behavior and historic normal behavior, which is less computationally expensive than the variable-length pattern matching algorithm proposed by Hofmeyr et al. At the detection stage, the temporal correlation of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy, and is especially suitable for online detection. It has been applied to practical hosted-based intrusion detection systems, and has achieved high detection performance.