Combining multiple host-based detectors using decision tree

Sang Jun Han, Sung Bae Cho

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Citations (Scopus)

Abstract

As the information technology grows interests in the intrusion detection system (IDS), which detects unauthorized usage, misuse by a local user and modification of important data, have been raised. In the field of anomaly-based IDS several artificial intelligence techniques are used to model normal behavior. However, there is no perfect detection method so that most of IDSs can detect the limited types of intrusion and suffers from its false alarms. Combining multiple detectors can be a good solution for this problem of conventional anomaly detectors. This paper proposes a detection method that combines multiple detectors using a machine learning technique called decision tree. We use conventional measures for intrusion detection and modeling methods appropriate to each measure. System calls, resource usage and file access events are used to measure user’s behavior and hidden Markov model, statistical method and rule-base method are used to model these measures which are combined with decision tree. Experimental results with real data clearly demonstrate the effectiveness of the proposed method that has significantly low false-positive error rate against various types of intrusion.

Original languageEnglish
Title of host publicationAI 2003
Subtitle of host publicationAdvances in Artificial Intelligence - 16th Australian Conference on AI, Proceedings
EditorsTamas D. Gedeon, Lance Chun Che Fung, Tamas D. Gedeon
PublisherSpringer Verlag
Pages208-220
Number of pages13
ISBN (Print)9783540206460
Publication statusPublished - 2003 Jan 1
Event16th Australian Conference on Artificial Intelligence, AI 2003 - Perth, Australia
Duration: 2003 Dec 32003 Dec 5

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume2903
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other16th Australian Conference on Artificial Intelligence, AI 2003
CountryAustralia
CityPerth
Period03/12/303/12/5

    Fingerprint

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

Han, S. J., & Cho, S. B. (2003). Combining multiple host-based detectors using decision tree. In T. D. Gedeon, L. C. C. Fung, & T. D. Gedeon (Eds.), AI 2003: Advances in Artificial Intelligence - 16th Australian Conference on AI, Proceedings (pp. 208-220). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 2903). Springer Verlag.