Host-based intrusion detection using dynamic and static behavioral models

By Dit-Yan Yeung, Yuxin Ding. Pattern Recognition, 2003

383 citations recorded by the source corpus.

Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1301e957ea2476f7b8b106f88c601f8323c5d53f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, methodology): “It also provides distributed attack detection capability Bayesian networks based anomaly detection Shyu et al. [36] It uses principal component analysis as an outlier detection scheme to detect intrusions Principal component analysis based anomaly detection Yeung et al. [40] It presents a dynamic mo”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, methodology): “This approach was taken by Yeung and Ding [152] for host-based intrusion detection using system call sequences.”
A Semantic Approach to Host-Based Intrusion Detection Systems Using Contiguousand Discontiguous System Call Patterns (2014, methodology): “HMM and entropy analysis of system calls [61] 91.”
Using Rough Set and Support Vector Machine for Network Intrusion Detection System (2009, background): “Most intrusion detection systems are classified as either a NIDS (Network Based Intrusion Detection System) or a HIDS (Host Based Intrusion Detection System) [6][13].”
Behavioural biometrics: a survey and classification (2008, background): “Overall, this line of research is extremely popular (Lane and Brodley, 1997a; 1997b; Marin et al., 2001; Yeung and Ding, 2002), but recently, a shift has been made towards user profiling in a graphical environment such as Windows as most users prefer convenience of a graphical user interface (GUI).”
Novelty detection: a review - part 1: statistical approaches (2003, methodology): “These approaches are more complex than the use of linear schemes of novelty detection (e.g. Elad et al ., 2002) and they are primarily aimed at data density estimation using robust statistics.”
A review of novelty detection (2014, methodology): “The “emission” probabilities of the observable events are determined by a set of probability distributions associated with each state, which can be thresholded to perform novelty detection [83].”
Anomaly-based network intrusion detection: Techniques, systems and challenges (2009, methodology): “Markov-based techniques have been extensively used in the context of host IDS, normally applied to system calls (Yeung and Ding, 2003).”
AdaBoost-Based Algorithm for Network Intrusion Detection (2008, methodology): “In recent years, the hidden Markov model has been used in intrusion detection based on host audit data [31], [32].”