A multi-layer model for anomaly intrusion detection using program sequences of system calls

IEEE International Conference on Networks, ICON

Volumn , Issue , 2003, Pages 531-536

  Hoang, Xuan Dau ^a   Hu, Jiankun ^a   Bertok, Peter ^a  

^a RMIT UNIVERSITY   (Australia)

Author keywords

Anomaly detection; Hidden Markov model; Intrusion detection; Machine learning; System call sequence

Indexed keywords

HIDDEN MARKOV MODELS; LEARNING SYSTEMS; ONLINE SYSTEMS;

ANOMALY DETECTION; ANOMALY INTRUSION DETECTION; BEHAVIOR-BASED; HIDDEN-MARKOV MODELS; INTRUSION-DETECTION; MACHINE-LEARNING; MULTILAYER MODELS; PROGRAM BEHAVIOR; SYSTEM CALLS; SYSTEM-CALL SEQUENCE;

INTRUSION DETECTION;

EID: 84890861404     PISSN: 15566463     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/icon.2003.1266245     Document Type: Conference Paper

References (14)

1. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff, "A sense of self for Unix processes," In Proceedings of 1996 IEEE Symposium on Computer Security and Privacy, 1996.
2. S. Forrest, S. A. Hofmeyr, and A. Somayaji, "Intrusion detection using sequences of system calls," Journal of Computer Security Vol. 6, pp. 151-180, 1998.
3. C. Warrender, S. Forrest, and B. Perlmutter, "Detecting intrusions using system calls: Alternative data models," In the Proceedings of the 1999 IEEE Computer Society Symposium on Research in Security and Privacy (Berkeley, CA, May). IEEE Computer Society Press, Los Alamitos, CA, pages 133-145, 1999.
4. D. E. Denning, "An intrusion detection model," in IEEE Transactions on Software Engineering, Los Alamos, CA, IEEE Press, 1987.
5. L. R. Rabiner, and B. H. Juang, "An introduction to Hidden Markov Models", in IEEE ASSP Magazine, January 1996.
6. R. Dugad, and U. B. Desai, "A tutorial on Hidden Markov Models," Technical report No.: SPANN-96.1, May 1996.
7. T. Kanungo, "Hidden Markov Models," www.cfar.umd.edu/~kanungo.
8. W. Lee, and S. J. Stolfo, "A Framework for Constructing Features and Models for Intrusion Detection Systems," In ACM Transactions on Information and System Security, Vol. 3, No. 4, pages 227-261, November 2000.
9. C. C. Micheal and A. Ghosh, "Simple, state-based approaches to program-based anomaly detection," ACM Transactions on Information and System Security, Vol. 5, No. 3, August 2002, pages 203-237.
10. R. Sekar, M. Bendre, Dhurjati, and P. Bullineni, "A fast automaton-based method for detecting anomalous program behaviours," IEEE Symposium on Security and Privacy, 2001. S&P 2001, Page(s): 144-155.
11. Y. Qiao, X.W. Xin, Y. Bin and S. Ge, "Anomaly intrusion detection method based on HMM," IEEE Electronic Letters Online No: 20020467, 2002.
12. University of New Mexico's Computer Immune Systems Project, http://www.cs.unm.edu/~immsec/systemcalls.htm.
13. J. Pikoulas, W. J. Buchanan, M. Mannion, and K. Triantafyllopoulos, "An agent-based Bayesian forecasting model for enhanced network security," In ECBS 2001 Proceedings on Engineering of Computer Based Systems - the Eighth Annual IEEE International Conference and Workshop, pages 247-254, 2001.
14. T. Lane, and C. E. Brodley, Approaches to Online Learning and Concept Drift for User Identification in Computer Security. American Association for Artificial Intelligence press, 1998.