An efficient hidden markov model training scheme for anomaly intrusion detection of server applications based on system calls

Proceedings - IEEE International Conference on Networks, ICON

Volumn 2, Issue , 2004, Pages 470-474

  Hoang, X D ^a   Hu, J ^a  

^a RMIT UNIVERSITY   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY INTRUSION DETECTION; HIDDEN MARKOV MODEL (HMM); MARKOV STATES; SYSTEM CALLS;

ALGORITHMS; COMPUTER PROGRAM LISTINGS; DATA MINING; DATA PROCESSING; DATABASE SYSTEMS; INTERNET; MARKOV PROCESSES; RANDOM PROCESSES; SERVERS; UNIX;

SECURITY OF DATA;

EID: 21644438395     PISSN: 15312216     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICON.2004.1409210     Document Type: Conference Paper

References (12)

1. Forrest S., Hofmeyr S. A., Somayaji A., and Longstaff T. A., "A sense of self for Unix processes". Proceedings of 1996 IEEE Symposium on Computer Security and Privacy, 1996.
2. Forrest S., Hofmeyr S. A., and Somayaji A., "Intrusion detection using sequences of system calls". Journal of Computer Security Vol. 6, pp. 151-180, 1998.
3. Warrender C., Forrest S., and Perlmutter B., "Detecting intrusions using system calls: Alternative data models". Proceedings of the 1999 IEEE Computer Society Sympo-sium on Research in Security and Privacy (Berkeley, CA, May). IEEE Computer Society Press, Los Alamitos, CA, pages 133-145, 1999.
4. Lee W., and Stolfo S. J., "A Framework for Constructing Features and Models for Intrusion Detection Systems". ACM Transactions on Information and System Security, Vol. 3, No. 4, pages 227-261, November 2000.
5. Qiao Y., Xin X. W., Bin Y., and Ge S., "Anomaly intrusion detection method based on HMM". IEEE Electronic Letters Online No: 20020467, 2002.
6. Hoang X. D., Hu J. and Bertok P., "A multi-layer model for anomaly intrusion detection using program sequences of system calls". International Conference on Network - ICON2003, pages 531-536, September 2003, Sydney, Australia.
7. Rabiner L. R., "A tutorial on hidden Markov model and selected applications in speech recognition", in Proceedings of IEEE, Vol. 77, No. 2, February 1989.
8. Dugad R., and U. B. Desai, "A tutorial on Hidden Markov Models," Technical report No.: SPANN-96.1, May 1996.
9. Davis R. I. A. and Lovell B. C., "Improved Estimation of Hidden Markov Model Parameters from Multiple Observation Sequences", in International Conference on Pattern Recognition, pages 168-171, Quebec City, Canada, August 2002.
10. Gotoh Y., Hochberg M. M., and Silverman H. F., "Efficient Training Algorithms for HMMs Using Incremental Estimation", IEEE TRANSACTIONS ON SPEECH AND AUDIO PROCESSING, VOL. 6, NO. 6, NOVEMBER 1998, pages 539-548.
11. The General Hidden Markov Model library (GHMM) web page: http://www.ghmm.org/.
12. University of New Mexico's Computer Immune Systems Project web page: http://www.cs.unm.edu/~immsec/systemcalls.htm.