Modeling system calls for intrusion detection with dynamic window sizes

Proceedings - DARPA Information Survivability Conference and Exposition II, DISCEX 2001

Volumn 1, Issue , 2001, Pages 165-175

  Eskin, E ^a   Lee, Wenke ^b   Stolfo, S J ^a  

^a Columbia University ^*  (United States)

^b North Carolina State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ENTROPY; MERCURY (METAL); SIGNAL DETECTION;

ANOMALY DETECTION; ANOMALY DETECTION MODELS; CONTEXT DEPENDENT; OPTIMAL WINDOW SIZE; PROBABILITY MODELING; PROCESS BEHAVIOR; SYSTEM CALL TRACES; TRADITIONAL SYSTEMS;

INTRUSION DETECTION;

EID: 84964540406     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DISCEX.2001.932213     Document Type: Conference Paper

References (18)

1. D. Denning. An intrusion detection model. IEEE Transactions on Software Engineering, SE-13:222-232, 1987.
2. E. Eskin. Anomaly detection over noisy data using learned probability distributions. In Proceedings of ICML 2000, Menlo Park, CA, 2000. AAAI Press.
3. E. Eskin, W. N. Grundy, and Y. Singer. Protein family classification using sparse markov transducers. In Proceedings of the Eighth International Conference on Intelligent Systems for Molecular Biology, Menlo Park, CA, 2000. AAAI Press.
4. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for unix processes. In Proceedings of the 1996 IEEE Symposium on Security and Privacy, pages 120-128. IEEE Computer Society, 1996.
5. A. Ghosh and A. Schwartzbard. A study in using neural networks for anomaly and misuse detection. In Proceedings of the Eighth USENIX Security Symposium, 1999.
6. P. Helman and J. Bhangoo. A statistically base system for prioritizing information exploration under uncertainty. IEEE Transactions on Systems, Man and Cybernetics, Part A: Systems and Humans, 27:449-466, 1997.
7. S. A. Hofmeyr, S. Forrest, and A. Somayaji. Intrusion detect using sequences of system calls. Journal of Computer Security, 6:151-180, 1998.
8. W. Lee and S. J. Stolfo. Data mining approaches for intrusion detection. In In Proceedings of the Seventh USENIX Security Symposium, 1998.
9. W. Lee, S. J. Stolfo, and P. K. Chan. Learning patterns from unix processes execution traces for intrusion detection. In In Proceedings of the AAAI-97 Workshop on AI Approaches to Fraud Detection and Risk Management, pages 50-56. Menlo Park, CA: AAAI Press, 1997.
10. W. Lee and D. Xiang. Information-theoretic measures for anomaly detection. In Proceedings of the 2001 IEEE Symposium on Security and Privacy, May 2001.
11. C. Marceau. Characterizing the behavior of a program using multiple-length n-grams. In Proceedings of the New Security Paradigms Workshop 2000, 2000.
12. MIT Lincoln Labs. 1999 DARPA intrusion detection evaluation. In http://www.ll.mit.edu/IST/ideval/index.html, 1999.
13. F. Pereira and Y. Singer. An efficient extension to mixture techniques for prediction and decision trees. Machine Learning, 36(3):183-199, 1999.
14. F. Provost, T. Fawcett, and R. Kohavi. The case against accuracy estimation for comparing induction algorithms. In Proceedings of the Fifteenth International Conference on Machine Learning, July 1998.
15. D. Ron, Y. Singer, and N. Tishby. The power of amnesia: Learning probabilistic automata with variable memory length. Machine Learning, 25:117-150, 1996.
16. Y. Singer. Adaptive mixtures of probabilistic transducers. Neural Computation, 9(8):1711-1734, 1997.
17. C. Warrender, S. Forrest, and B. Pearlmutter. Detecting intrusions using system calls: alternative data models. In Proceedings of the 1999 IEEE Symposium on Security and Privacy, pages 133-145. IEEE Computer Society, 1999.
18. N. Ye. A markov chain model of temporal behavior for anomaly detection,. In Proceedings of the 2000 IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, 2000.