Non-stationary Markov models and anomaly propagation analysis in IDS

Proceedings - IAS 2007 3rd Internationl Symposium on Information Assurance and Security

Volumn , Issue , 2007, Pages 203-208

  Tokhtabayev, Amur G ^a   Skormin, Victor A ^a  

^a State University of New York at Binghamton

Author keywords

Anomaly propagation; Intrusion detection; Markov models

Indexed keywords

ANOMALY BASED IDS; ANOMALY DETECTIONS; DEGREE OF CERTAINTY; FALSE ALARMS (FA); FALSE POSITIVE (FP); HOST LEVEL; HOST-BASED; INFORMATION ASSURANCE AND SECURITY (IAS); MARKOV CHAINS; MARKOV MODELLING; MODEL ACCURACY; NON STATIONARY; SERVER-BASED; SYSTEM CALLS;

ADMINISTRATIVE DATA PROCESSING; ALARM SYSTEMS; COMPUTER WORMS; CRACK PROPAGATION; FINANCIAL DATA PROCESSING; MARKOV PROCESSES; SECURITY OF DATA; SERVERS;

STOCHASTIC MODELS;

EID: 46749137951     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IAS.2007.72     Document Type: Conference Paper

References (13)

1. S. A. Hofmeyr, S. Forrest, and A. Somayaji, "Intrusion detection using sequences of system calls," Journal of Computer Security, vol. 6, no. 3, pp. 151-180, 1998.
2. A Durante, R Di Pietro, LV Mancini. "Formal Specification for Fast Automatic IDS Training" Lecture Notes in Computer Science, 2629:191-204, 2003.
3. S. Stolfo, W. Lee, E. Eskin. "Modeling system calls for ID with Dynamic Window Sizes", In Proceedings of the DISCEX II. June 2001.
4. V. Skormin, A. Volynkin, D. Summerville, J. Moronski, "Run-Time Detection of Malicious Self-Replication in Binary Executables" Journal of Computer Security, 15, 2007.
5. A. Liu, C. Martin. "A Comparison of System Call Feature Representations for Insider Threat Detection". In Proceedings of the 6th IEEE Information Assurance Workshop, 2005.
6. G. Tandon, P. Chan. "Learning Useful System Call Attributes for Anomaly Detection", In Proceedings of the FLAIRS Conference, 2005.
7. T. Bowen, M. Segal, and R. Sekar "On preventing intrusions by process behavior monitoring". In Proceedings of the Workshop on Intrusion Detection and Network Monitoring, 1999.
8. M. Xu, C. Chen, J. Ying "Anomaly detection based on system call classification". Journal of Software, 15(3): pp. 391-403, 2004.
9. C. Kruegel, D. Mutz, F. Valeur and G. Vigna. "On the Detection of Anomalous System Call Arguments". ESORICS, Oct. 2003.
10. M. Bernaschi, E. Grabrielli, L. Mancini "Operating System Enhancements to Prevent the Misuse of System Calls", In Proceedings of the ACM Conference on Computer and Communications Security, pp. 174 - 183, 2000.
11. D. Kang, D. Fuller, and V. Honavar "Learning classifiers for misuse and anomaly detection using a bag of system calls representation". In Proceedings of 6th IEEE Systems Man and Cybernetics Information Assurance Workshop (IA W), pp. 118-125, 2005.
12. J. Gottman, R. Kumar. "Sequential analysis. A guide for behavioral researchers", Cambridge: Cambridge University Press, 1990.
13. D. Malan and M. Smith "Exploiting Temporal Consistency to Reduce False Positives in Host-Based, Collaborative Detection of Worms" In Proceedings of the ACM Workshop on Recurring Malcode, 2006