Detecting network intrusions by data mining and variable-length sequence pattern matching  

作　　者：Tian Xinguang Duan Miyi Sun Chunlai Liu Xin 

机构地区：[1]Inst. of Computing Technology, Chinese Academy of Sciences, Beijing 100190, P. R. China [2]Inst. of Computing Technology, Beijing Jiaotong Univ., Beijing 100029, P. R. China

出　　处：《Journal of Systems Engineering and Electronics》2009年第2期405-411,共7页系统工程与电子技术（英文版）

基　　金：supported by the National Grand Fundamental Research "973" Program of China (2004CB318109);the National High-Technology Research and Development Plan of China (2006AA01Z452);the National Information Security "242"Program of China (2005C39).

摘　　要：Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.Anomaly detection has been an active research topic in the field of network intrusion detection for many years. A novel method is presented for anomaly detection based on system calls into the kernels of Unix or Linux systems. The method uses the data mining technique to model the normal behavior of a privileged program and uses a variable-length pattern matching algorithm to perform the comparison of the current behavior and historic normal behavior, which is more suitable for this problem than the fixed-length pattern matching algorithm proposed by Forrest et al. At the detection stage, the particularity of the audit data is taken into account, and two alternative schemes could be used to distinguish between normalities and intrusions. The method gives attention to both computational efficiency and detection accuracy and is especially applicable for on-line detection. The performance of the method is evaluated using the typical testing data set, and the results show that it is significantly better than the anomaly detection method based on hidden Markov models proposed by Yan et al. and the method based on fixed-length patterns proposed by Forrest and Hofmeyr. The novel method has been applied to practical hosted-based intrusion detection systems and achieved high detection performance.

关 键 词：intrusion detection anomaly detection system call data mining variable-length pattern 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP311.56[自动化与计算机技术—计算机科学与技术]