Title

Exploiting Pattern Relationship For Intrusion Detection

Keywords

Aggregates; Application software; Computer science; Data mining; Data preprocessing; Internet; Intrusion detection; Pattern matching; Protection; Testing

Abstract

The problem of identifying patterns from system call trails of UNIX processes to better model application behavior has been investigated intensively. Most existing approaches focus on capturing the relationship between individual system calls (or system audit events). We add one additional dimension to the problem domain by also taking into consideration the overlap relationship between patterns. We first present a pattern extraction algorithm to generate maximal patterns from system call trails. Overlap relationship between patterns is subsequently investigated and stored Finally, both maximal patterns and their relationships are exploited to detect deviations from normal application behavior. We test this idea using the popular sendmail data set and the login data set obtained from the University of New Mexico. Experimental results indicate that our scheme achieves a much higher detection rate than systems that only consider intra-pattern relationship while maintaining a very low false alarm rate with similar space and time efficiency.

Publication Date

1-1-2003

Publication Title

Proceedings - 2003 Symposium on Applications and the Internet, SAINT 2003

Number of Pages

200-208

Document Type

Article; Proceedings Paper

Personal Identifier

scopus

DOI Link

https://doi.org/10.1109/SAINT.2003.1183049

Socpus ID

60349129462 (Scopus)

Source API URL

https://api.elsevier.com/content/abstract/scopus_id/60349129462

This document is currently not available here.

Share

COinS