An improved Hidden Markov Model for anomaly detection using frequent common patterns

IEEE International Conference on Communications

Volumn , Issue , 2012, Pages 1113-1117

  Sultana, Afroza ^a   Hamou Lhadj, Abdelwahab ^a   Couture, Mario ^b  

^a Dept of Electrical and Computer Engineering   (Canada)

^b DEFENCE RESEARCH AND DEVELOPMENT CANADA VALCARTIER   (Canada)

Author keywords

Behavioral modeling; HMM; Host based Anomanly Detection Systems; N gram extraction algorithm

Indexed keywords

ABNORMAL BEHAVIOR; ACCURACY RATE; ANOMALY DETECTION; BEHAVIORAL MODELING; DETECTION SYSTEM; EXECUTION TRACE; EXTRACTION ALGORITHMS; HMM; HMM ALGORITHM; HOST-BASED INTRUSION DETECTION; HOST-BASED INTRUSION DETECTION SYSTEM; N-GRAMS; OFFLINE; ON-LINE DETECTION; REFERENCE MODELS; SENSITIVE DATAS; SHOW THROUGH; SOFTWARE SYSTEMS; SOURCE CODES; TRAINING TIME;

ALGORITHMS; INTRUSION DETECTION;

HIDDEN MARKOV MODELS;

EID: 84871977083     PISSN: 15503607     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2012.6364527     Document Type: Conference Paper

References (30)

1. V. V. Phohaha, "The Springer Internet Security Dictionary," Springer-Verlag, 2002.
2. P. E. Proctor, "The Practical Intrusion Detection Handbook," Prentice Hall PTR, NJ, USA, 2001.
3. V. Chandola, A. Banerjee, V. Kumar, "Anomaly detection: A survey," ACM Computing Surveys, vol. 41(3), article: 15, July 2009.
4. S. Kumar, and E. H. Spafford, "A pattern matching model for misuse intrusion detection," In Proceedings of the National Computer Security Conference, Baltimore, MD, 1994, pp. 11-21.
5. D. E. Denning, "An Intrusion Detection Model," IEEE Transactions on Software Engineering, SE, vol. 13(2), 1987, pp. 222-232.
6. S. Forrest, P. D'haeseleer, and P. Helam, "An immunological approach to change detection: Algorithms, analysis and implications". In Proceedings of the IEEE Symposium on Security and Privacy, IEEE Computer Society, vol. 110, 1996.
7. D. Endler, "Intrusion detection: applying machine learning to solaris audit data," In Proceedings of the IEEE Annual Computer Security Application Conference, Society Press, 1998, pp. 268 - 279.
8. Guofei Jiang, Haifeng Chen, Cristian Ungureanu and Kenji Yoshihara, "Trace analysis for fault detection for application server", Handbook of Automatic Computing: Concepts, Infrastructures, and Applications, edited by S. Hariri, and P. Parashar, CRC Press, 2007.
9. C. Warrender, S. Forrest, and B. Pearlmutter, "Detecting intrusions using system calls: Alternate data models," In Proceedings of the IEEE ISRSP. IEEE Computer Society, 1999, pp. 133 - 145.
10. J. Hu, Q. Dong, X. Yu, and H. H. Chen, "A simple and efficient hidden markov model scheme for host-based anomaly intrusion detection," IEEE Netw. vol. 23(1), 2009, pp. 42 - 47.
11. Jiankun Hu, "Host-Based Anomaly Intrusion Detection", Handbook of Information and Communication Security, Springer, 2010.
12. S. Forrest, S. A. Hofmeyr, A. Somayaji. and T. A. Longstaff, "A sense of self for unix processes," In Proceedings of the IEEE ISRSP, 1996, pp. 120 - 128.
13. E. Eskin, "Anomaly detection over noisy data using learned probability distributions," In Proceedings of the 17th International Conference on Machine Learning. Morgan Kaufmann Publishers Inc., 2000, pp. 255-262.
14. E. Eskin, W. Lee, and S. Stolfo, "Modeling system call for intrusion detection using dynamic window sizes," In Proceedings of DARPA Information Survivability Conference and Exposition (DISCEX), 2001.
15. th USENIX Security Symposium, 1999.
16. N. Abouzakhar, A. Gani, G. Manson, M. Abutbel, and D. King, "Bayesian learning network approach to cybercrime detection," In Proceedings of the 2003 Post Graduate Networking Conference, Liverpool, United Kingdom, 2003.
17. W. Hu, Y. Liao, and V. R. Vemuri, "Robust anomaly detection using support vector machines," In Proceedings of the International Conference on Machine Learning. Morgan Kaufmann Publishers Inc., 2003, pp. 282-289.
18. rd Annual Southeast Regional Conference, Georgia, 2005, pp. 136 - 141.
19. Q. Xu, W. Pei, and Q. Zhao, "An intrusion detection approach based on understandable neural network trees," Journal of Electronics, 2007, pp. 574 - 579.
20. R. C. Chen, K. F. Cheng, Y. H. Chen, C. F., Hsieh, "Using Rough Set and Support Vector Machine for Network Intrusion Detection System," In proceedings of the First Asian Conference on Intelligent Information and Database Systems, 2009, pp. 465 - 470.
21. L. R. Rabiner and B. H. Juang, "An introduction to hidden markov models," IEEE ASSP Magazine, 1986.
22. P. F. Brown, V. J. Della Pietra, P. V. deSouza, J. C. Lai, and R. L. Mercer, "Class-based n-gram models of natural language", Computational Linguistics, vol. 18, pp. 467-479, 1992.
23. Gzip Official Website http://www.gzip.org/
24. M. Desnoyers, and M. R. Degenais, "The LTTng tracer: A low impact performance and behavior monitor for GNU/Linux," In Proceedings of Ottawa Linux Symposium, Ottawa, Canada, July 19-22, 2006.
25. LTTng Official Website. http://lttng.org
26. Weka Official Website http://www.cs.waikato.ac.nz/ml/weka/
27. Leonard E. Baum, Ted Petrie, George Soules and Norman Weiss, "A Maximization Technique Occurring in the Statistical Analysis of Probabilistic Functions of Markov Chains", The Annals of Mathematical Statistics, vol. 41(1), February, 1970, pp. 164 - 171.
28. nd edition, San Francisco: Elsevier, 2006.
29. S. Forrest, S. A. Hofmeyr, A. Somayaji and T. A. Longstaff, "A sense of self for Unix processes," In Proceedings of IEEE Symposium on Security and Privacy, Oakland, CA, USA, May 6-8, 1996, pp. 120-128.
30. C. C. Michael and A. Ghosh, "Simple, state-based approaches to program-based anomaly detection," ACM Transaction on Information and System Security (TIISSEC), vol. 5(3), pp. 203 - 237, August 2002.