Applying mining fuzzy association rules to intrusion detection based on sequences of system calls

Authors:
Guiling Zhang
Affiliations:
Department of Electronic Information Engineering, Tianjin University
Venue:
ICCNMC'05 Proceedings of the Third international conference on Networking and Mobile Computing
Year:
2005

Citing 9
Cited 0

Mining quantitative association rules in large relational tables

SIGMOD '96 Proceedings of the 1996 ACM SIGMOD international conference on Management of data
Mining fuzzy association rules in databases

ACM SIGMOD Record
Detection and classification of intrusions and faults using sequences of system calls

ACM SIGMOD Record
Fast Algorithms for Mining Association Rules in Large Databases

VLDB '94 Proceedings of the 20th International Conference on Very Large Data Bases
A Fuzzy Data Mining Based Intrusion Detection Model

FTDCS '04 Proceedings of the 10th IEEE International Workshop on Future Trends of Distributed Computing Systems
Data mining approaches for intrusion detection

SSYM'98 Proceedings of the 7th conference on USENIX Security Symposium - Volume 7
Intrusion detection using sequences of system calls

Journal of Computer Security
A sense of self for Unix processes

SP'96 Proceedings of the 1996 IEEE conference on Security and privacy
Intrusion detection techniques and approaches

Computer Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion detection is an important technique for computer and information system. S. Forrest and coworkers present us that short sequences of system calls are good signature descriptions for anomalous intrusion detection [10]. This paper extends their works by applying mining fuzzy association rules to intrusion detection. After giving a primary classification of system calls based on threat level and its classification identifier numbers, we generate series short sequences of sendmail trace data and transform them into fuzzy expression. Then we extract the Most Dangerous Sequences Database (MDSD) from the fuzzy expression data, according to the specific threshold. For the MDSD database, we apply mining fuzzy association rules to detect each sequence is “normal” or “abnormal”. The prototype experimental results demonstrate that the proposed method gives enough ability for intrusion detection.