A hybrid high-order markov chain model for computer intrusion detection

Journal of Computational and Graphical Statistics

Volumn 10, Issue 2, 2001, Pages 277-295

  Ju, Wen Hua ^a   Vardi, Yehuda ^b  

^a AVAYA LABS RESEARCH   (United States)

^b RUTGERS UNIVERSITY   (United States)

Author keywords

Anomaly detection; EM algorithm; LININPOS; Mixture transition distribution (MTD); Unix

Indexed keywords

EID: 0035616570     PISSN: 10618600     EISSN: 15372715     Source Type: Journal    
DOI: 10.1198/10618600152628068     Document Type: Article

References (17)

1. Amoroso, E. G. (1999), Intrusion Detection: An Introduction to Internet Surveillance, Correlation, Trace Back, Traps, and Response, Intrusion. NetBooks, http://www.intrusion.net.
2. Anderson, D., Frivold, T., and Valdes, A. (1995), “Next-Generation IntrusionDetection Expert System (NIDES): A Summary,” Technical Report SRI-CSL-95-07, Computer Science Laboratory, SRI International.
3. Balasubramaniyan, J., Garcia-Fernandez, J. O., Isacoff, D., Spafford, E. H., and Zamboni, D. (1998), “An Ar chitecture for Intrusion Detection using Autonomous Agents,” Coast TR 98-05, Department of Computer Sciences, Purdue University.
4. CSIDS (1999), “Cisco Secure Intrusion Detection System Technical Overview,” Available at http://www.wheelgroup.com/warp/public/cc/cisco/mkt/security/nranger/tech/ntran_tc.htm.
5. Dempster, A. P., Laird, N. M., and Rubin, D. B. (1977), “MaximumLikelihoodfrom Incomplete Data via the EM Algorithm” (with discussion), Journal of the Royal Statistical Society, Ser. B, 39, 1-38.
6. Hofmeyer, S. A., Somayaji, A., and Forrest, S. (1998), “Intrusion Detection using Sequences of System Calls,” Journalof ComputerSecurity, 6, 151-180.
7. Frank, J. (1994), “Artificial Intelligence and Intrusion Detection: Current and Future Directions,” Proceedings of the 17thNational Computer Security Conferences.
8. Iusem, A. N., and Svaiter, B. F. (1994), “A New Smoothing-RegularizationApproachfor a Maximum-Likelihood Estimation Problem,” Applied Mathematics and Optimization: An International Journal, 29, 225-241.
9. Lawrence, C. T., Zhou, J. L., and Tits, A. L. (1997), “User’s Guidefor CFSQPVersion 2. 5: A C Codefor Solving (Large Scale) Constrained Nonlinear (Minimax) Optimization Problems, Generating Iterates Satisfying All Inequality Constraints,” Technical Report TR-94-16r1, Institute for Systems Research, University of Maryland.
10. Northcult, S. (1999), Network Intrusion Detection: An Analysis Handbook, New Riders Publishing, http://www.newriders.com.
11. Raftery, A. E. (1985), “A Model for Highorder Markov Chains,” Journal of the Royal Statistical Society, Ser. B, 47, 528-539.
12. Raftery, A. E., and Tavare, S. (1994), “Estimation and Modeling Repeated Patterns in High Order Markov Chains with the Mixture Transition Distribution Model,” AppliedStatistics, 43, 179-199.
13. Schonlau, M., DuMouchel, W., Ju, W. -H., Karr, A., Theus, M. andVardi, Y. (1999), “ComputerIntrusion:Detecting Masqueraders,” Technical Report 95, National Institute of Statistical Sciences.
14. Theus, M., and Schonlau, M. (1998), “Intrusion Detection Based on Structural Zeros,” Statistical Computing & GraphicsNewsletter, 9, 12-17.
15. Vardi, Y. (1996), “Network Tomography: Estimating Source-Destination Traffic Intensities From Link Data,” Journal of the American Statistical association, 91, 365-377.
16. Vardi, Y., and Lee, D. (1993), “From Image Deblurring to Optimal Investments: Maximum Likelihood Solutions for PositiveLinear Inverse Problems” (with discussion), Journal of the RoyalStatisticalSociety, Ser. B, 55, 569-612.
17. Warrender, C., Forrest, S., and Pearlmutter, B. (1999), “Detecting Intrusion Using SystemCalls: Alternative Data Models,” in 1999 IEEE Symposium on Security and Privacy, pp. 133-145