Learning classifiers for misuse detection using a bag of system calls representation

Authors:
Dae-Ki Kang;Doug Fuller;Vasant Honavar
Affiliations:
Artificial Intelligence Lab, Department of Computer Science, Iowa State University;Scalable Computing Lab., Iowa State University and U.S. Department of Energy;Artificial Intelligence Lab, Department of Computer Science, Iowa State University
Venue:
ISI'05 Proceedings of the 2005 IEEE international conference on Intelligence and Security Informatics
Year:
2005

Citing 2
Cited 6

Intrusion detection using sequences of system calls

Journal of Computer Security
A sense of self for Unix processes

SP'96 Proceedings of the 1996 IEEE conference on Security and privacy

Sequential anomaly detection based on temporal-difference learning: Principles, models and case studies

Applied Soft Computing
Use of dimensionality reduction for intrusion detection

ICISS'07 Proceedings of the 3rd international conference on Information systems security
A misleading attack against semi-supervised learning for intrusion detection

MDAI'10 Proceedings of the 7th international conference on Modeling decisions for artificial intelligence
Intrusion detection using continuous time Bayesian networks

Journal of Artificial Intelligence Research
An Optimum-Path Forest framework for intrusion detection in computer networks

Engineering Applications of Artificial Intelligence
Sampling attack against active learning in adversarial environment

MDAI'12 Proceedings of the 9th international conference on Modeling Decisions for Artificial Intelligence

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we propose a “bag of system calls” representation for intrusion detection of system call sequences and describe misuse detection results with widely used machine learning techniques on University of New Mexico (UNM) and MIT Lincoln Lab (MIT LL) system call sequences with the proposed representation. With the feature representation as input, we compare the performance of several machine learning techniques and show experimental results. The results show that the machine learning techniques on simple “bag of system calls” representation of system call sequences is effective and often perform better than those approaches that use foreign contiguous subsequences for detecting intrusive behaviors of compromised processes.