Detecting intrusions using system calls: alternative data models
Top Cited Papers
- 20 January 2003
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- No. 10816011,p. 133-145
- https://doi.org/10.1109/secpri.1999.766910
Abstract
Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. We study one such observable-sequences of system calls into the kernel of an operating system. Using system-call data sets generated by several different programs, we compare the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions. We compare the following methods: simple enumeration of observed sequences; comparison of relative frequencies of different sequences; a rule induction technique; and hidden Markov models (HMMs). We discuss the factors affecting the performance of each method and conclude that for this particular problem, weaker methods than HMMs are likely sufficient.Keywords
This publication has 11 references indexed in Scilit:
- A sense of self for Unix processesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Intrusion detection using sequences of system callsJournal of Computer Security, 1998
- A statistically based system for prioritizing information exploration under uncertaintyIEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans, 1997
- The power of amnesia: Learning probabilistic automata with variable memory lengthMachine Learning, 1997
- Intrusion detection via system call tracesIEEE Software, 1997
- Gauging Similarity with n -Grams: Language-Independent Categorization of TextScience, 1995
- Fast Effective Rule InductionPublished by Elsevier ,1995
- Learning stochastic regular grammars by means of a state merging methodPublished by Springer Nature ,1994
- A tutorial on hidden Markov models and selected applications in speech recognitionProceedings of the IEEE, 1989
- An introduction to hidden Markov modelsIEEE ASSP Magazine, 1986