Intrusion detection based on system calls and homogeneous Markov chains

A novel method for detecting anomalous program behavior is presented, which is applicable to hostbased intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain model to characterize the normal behavior of a privileged program, and associates the states of the Markov chain with the unique system calls in the training data. At the detection stage, the probabilities that the Markov chain model supports the system call sequences generated by the program are computed. A low probability indicates an anomalous sequence that may result from intrusive activities. Then a decision rule based on the number of anomalous sequences in a locality frame is adopted to classify the program＇s behavior. The method gives attention to both computational efficiency and detection accuracy, and is especially suitable for on-line detection. It has been applied to practical host-based intrusion detection systems.

An Intrusion Detection Method Based on Hierarchical Hidden Markov Models

This paper presents an anomaly detection approach to detect intrusions into computer systems. In this approach, a hierarchical hidden Markov model （HHMM） is used to represent a temporal profile of normal behavior in a computer system. The HHMM of the norm profile is learned from historic data of the system＇s normal behavior. The observed behavior of the system is analyzed to infer the probability that the HHMM of the norm profile supports the observed behavior. A low probability of support indicates an anomalous behavior that may result from intrusive activities. The model was implemented and tested on the UNIX system call sequences collected by the University of New Mexico group. The testing results showed that the model can clearly identify the anomaly activities and has a better performance than hidden Markov model.

Classification Model with High Deviation for Intrusion Detection on System Call Traces

A new classification model for host intrusion detection based on the unidentified short sequences and RIPPER algorithm is proposed. The concepts of different short sequences on the system call traces are strictly defined on the basis of in-depth analysis of completeness and correctness of pattern databases. Labels of short sequences are predicted by learned RIPPER rule set and the nature of the unidentified short sequences is confirmed by statistical method. Experiment results indicate that the classification model increases clearly the deviation between the attack and the normal traces and improves detection capability against known and unknown attacks.

Markov Graph Model Computation and Its Application to Intrusion Detection

Markov model is usually selected as the base model of user action in the intrusion detection system (IDS). However, the performance of the IDS depends on the status space of Markov model and it will degrade as the space dimension grows. Here, Markov Graph Model (MGM) is proposed to handle this issue. Specification of the model is described, and several methods for probability computation with MGM are also presented. Based on MGM, algorithms for building user model and predicting user action are presented. And the performance of these algorithms such as computing complexity, prediction accuracy, and storage requirement of MGM are analyzed.

Cross-Layer Hidden Markov Analysis for Intrusion Detection

Ad hoc mobile cloud computing networks are affected by various issues,like delay,energy consumption,flexibility,infrastructure,network lifetime,security,stability,data transition,and link accomplishment.Given the issues above,route failure is prevalent in ad hoc mobile cloud computing networks,which increases energy consumption and delay and reduces stability.These issues may affect several interconnected nodes in an ad hoc mobile cloud computing network.To address these weaknesses,which raise many concerns about privacy and security,this study formulated clustering-based storage and search optimization approaches using cross-layer analysis.The proposed approaches were formed by cross-layer analysis based on intrusion detection methods.First,the clustering process based on storage and search optimization was formulated for clustering and route maintenance in ad hoc mobile cloud computing networks.Moreover,delay,energy consumption,network lifetime,and link accomplishment are highly addressed by the proposed algorithm.The hidden Markov model is used to maintain the data transition and distributions in the network.Every data communication network,like ad hoc mobile cloud computing,faces security and confidentiality issues.However,the main security issues in this article are addressed using the storage and search optimization approach.Hence,the new algorithm developed helps detect intruders through intelligent cross layer analysis with theMarkov model.The proposed model was simulated in Network Simulator 3,and the outcomes were compared with those of prevailing methods for evaluating parameters,like accuracy,end-to-end delay,energy consumption,network lifetime,packet delivery ratio,and throughput.

Integration of Expectation Maximization using Gaussian Mixture Models and Naïve Bayes for Intrusion Detection

Intrusion detection is the investigation process of information about the system activities or its data to detect any malicious behavior or unauthorized activity.Most of the IDS implement K-means clustering technique due to its linear complexity and fast computing ability.Nonetheless,it is Naïve use of the mean data value for the cluster core that presents a major drawback.The chances of two circular clusters having different radius and centering at the same mean will occur.This condition cannot be addressed by the K-means algorithm because the mean value of the various clusters is very similar together.However,if the clusters are not spherical,it fails.To overcome this issue,a new integrated hybrid model by integrating expectation maximizing(EM)clustering using a Gaussian mixture model(GMM)and naïve Bays classifier have been proposed.In this model,GMM give more flexibility than K-Means in terms of cluster covariance.Also,they use probabilities function and soft clustering,that’s why they can have multiple cluster for a single data.In GMM,we can define the cluster form in GMM by two parameters:the mean and the standard deviation.This means that by using these two parameters,the cluster can take any kind of elliptical shape.EM-GMM will be used to cluster data based on data activity into the corresponding category.

Efficient Accurate Context-Sensitive Anomaly Detection

For program behavior-based anomaly detection, the only way to ensure accurate monitoring is to construct an efficient and precise program behavior model. A new program behavior-based anomaly detection model, called combined pushdown automaton (CPDA) model was proposed, which is based on static binary executable analysis. The CPDA model incorporates the optimized call stack walk and code instrumentation technique to gain complete context information. Thereby the proposed method can detect more attacks, while retaining good performance.

Detecting network intrusions by data mining and variable-length sequence pattern matching

Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.

Novel design concepts for network intrusion systems based on dendritic cells processes

An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism that could be used to reduce the complexity of a search space, a mechanism for development of highly specialized detector sets as well as a selective mechanism used in directing subsets of detectors to be activated when certain danger signals are present. It is shown that DCs, primed by different danger signals, provide a basis for different anomaly detection pathways. Different antigen-peptides are developed based on different danger signals present, and these peptides are presented to different adaptive layer detectors that correspond to the given danger signal. Experiments are then undertaken that compare current approaches, where a full antigen structure and the whole repertoire of detectors are used, with the proposed approach. Experiment results indicate that such an approach is feasible and can help reduce the complexity of the problem by significant levels. It also improves the efficiency of the system, given that only a subset of detectors are involved during the detection process. Having several different sets of detectors increases the robustness of the resulting system. Detectors developed based on peptides are also highly discriminative, which reduces the false positives rates, making the approach feasible for a real time environment.

Anomaly detection of user behavior based on DTMC with states of variable-length sequences

In anomaly detection, a challenge is how to model a user＇s dynamic behavior. Many previous works represent the user behavior based on fixed-length models. To overcome their shortcoming, we propose a novel method based on discrete-time Markov chains （DTMC） with states of variable-length sequences. The method firstly generates multiple shell command streams of different lengths and combines them into the library of general sequences. Then the states are defined according to variable-length behavioral patterns of a valid user, which improves the precision and adaptability of user profiling. Subsequently the transition probability matrix is created. In order to reduce computational complexity, the classification values are determined only by the transition probabilities, then smoothed with sliding windows, and finally used to discriminate between normal and abnormal behavior. Two empirical evaluations on datasets from Purdue University and AT＆T Shannon Lab show that the proposed method can achieve higher detection accuracy and require less memory than the other traditional methods.

系统调用序列的Markov模型及其在异常检测中的应用

建立了计算机系统中系统调用序列的Markov模型，并在此模型的基础上提出了一种用于计算机异常检测的方法。文章利用统计方法分析进程中系统调用的发生情况，定义了一个依赖于状态转移概率的失配因子，并用它来计算失配率，由此判断被监视进程进行的操作是正常行为还是异常行为，文章还提出了一种基于遗忘因子的状态转移概率的更新算法。

基于系统调用和齐次Markov链模型的程序行为异常检测

异常检测是目前入侵检测领域研究的热点内容.提出一种新的基于系统调用和Markov链模型的程序行为异常检测方法,该方法利用一阶齐次Markov链对主机系统中特权程序的正常行为进行建模,将Markov链的状态同特权程序运行时所产生的系统调用联系在一起,并引入一个附加状态;Markov链参数的计算中采用了各态历经性假设;在检测阶段,基于状态序列的出现概率对特权程序当前行为的异常程度进行分析,并根据Markov链状态的实际含义和程序行为的特点,提供了两种可选的判决方案.同现有的基于隐Markov模型和基于人工免疫原理的检测方法相比,提出的方法兼顾了计算成本和检测准确度,特别适用于在线检测.该方法已应用于实际入侵检测系统,并表现出良好的检测性能.

基于改进遗传算法和隐Markov模型的协议异常检测方法

针对现有基于隐Markov模型的协议异常检测方法中存在的训练样本不足和初始参数敏感问题,提出一种基于改进遗传算法和隐Markov模型的协议异常检测新方法。首先,采用局部竞争选择策略、算术交叉算子和自适应非均匀变异算子改进遗传算法,避免传统遗传算法在收敛过程中的早熟和停滞问题;然后,利用改进的遗传算法优化隐Markov模型的初始参数,解决模型对初始参数敏感的问题;最后,以协议关键词和关键词时间间隔作为训练观测值,细粒度地描述协议行为,扩大模型的训练样本空间。在DARPA 1999数据集上的实验结果表明,该方法具有很高的检测率和较低的误报率。

基于Markov Chain的协议异常检测模型

本文介绍了基于Markov链的协议异常检测模型,此外,通过对MIT Lincoln实验室1999评估数据的分析,证明此模型的正确性和有效性。

一种新的基于Markov链模型的用户行为异常检测方法

提出一种新的基于Markov链模型的用户行为异常检测方法。该方法利用一阶齐次Markov链对网络系统中合法用户的正常行为进行建模,将Markov链的状态同用户执行的shell命令序列联系在一起,并引入一个附加状态;在检测阶段,基于状态序列的出现概率对用户当前行为的异常程度进行分析,并根据Markov链状态的实际含义和用户行为的特点, 采用了较为特殊的判决准则。与Lane T提出的基于隐Markov模型的检测方法相比,该方法的计算复杂度较低,更适用于在线检测。而同基于实例学习的检测方法相比,该方法则在检测准确率方面具有较大优势。文中提出的方法已在实际入侵检测系统中得到应用,并表现出良好的检测性能。

基于Shell命令和多阶Markov链模型的用户伪装攻击检测

伪装攻击是指非授权用户通过伪装成合法用户来获得访问关键数据或更高层访问权限的行为.提出一种新的用户伪装攻击检测方法.该方法针对伪装攻击用户行为的多变性和审计数据shell命令的相关性,利用特殊的多阶齐次Markov链模型对合法用户的正常行为进行建模,并通过双重阶梯式归并shell命令来确定状态,提高了用户行为轮廓描述的准确性和检测系统的泛化能力,并大幅度减少了存储成本.检测阶段根据实时性需求,采用运算量小的、仅依赖于状态转移概率的分类值计算方法,并通过加窗平滑处理分类值序列得到判决值,进而对被监测用户的行为进行判决.实验表明,同现有的典型检测方法相比,该方法在虚警概率相同的情况下大幅度提高了检测概率,并有效减少了系统计算开销,特别适用于在线检测.

基于shell命令和Markov链模型的用户行为异常检测

异常检测是目前入侵检测系统(IDS)研究的主要方向。该文提出一种基于shell命令和Markov链模型的用户行为异常检测方法,该方法利用一阶齐次Markov链对网络系统中合法用户的正常行为进行建模,将Markov链的状态与用户执行的shell命令联系在一起,并引入一个附加状态;Markov链参数的计算中采用了运算量较小的命令匹配方法;在检测阶段,基于状态序列的出现概率对被监测用户当前行为的异常程度进行分析,并提供了两种可选的判决方案。文中提出的方法已在实际入侵检测系统中得到应用,并表现出良好的检测性能。

基于shell命令和Markov链模型的用户伪装攻击检测

提出一种新的基于shell命令的用户伪装攻击检测方法。该方法在训练阶段充分考虑了用户行为的多变性和伪装攻击的特点,采用平稳的齐次Markov链对合法用户的正常行为进行建模,根据shell命令的出现频率进行阶梯式数据归并来划分状态,同现有的Markov链方法相比大幅度减少了状态个数和转移概率矩阵的存储量,提高了泛化能力。针对检测实时性需求和shell命令操作的短时相关性,采用了基于频率优先的状态匹配方法,并通过对状态短序列的出现概率进行加窗平滑滤噪处理来计算判决值,能够有效减少系统计算开销,降低误报率。实验表明,该方法具有很高的检测准确率和较强的可操作性,特别适用于在线检测。

基于Markov的无线传感器网络入侵检测机制

本文采用Markov线性预测模型,为无线传感器网络设计了一种基于流量预测的拒绝服务攻击检测方案——MPDD。在该方案中,每个节点基于流量预测判断和检测异常网络流量,无需特殊的硬件支持和节点之间的合作;提出了一种报警评估机制,有效提高方案的检测准确度,减少了预测误差或信道误码所带来的误报。仿真实验结果表明,Markov模型具有较高的预测精度,能够实时地预测传感器网络流量;MPDD方案能够快速、有效地检测拒绝服务攻击且消耗资源较少。