Two sophisticated techniques to improve HMM-based intrusion detection systems

Sung-Bae Cho, Sang Jun Han

Research output: Contribution to journalArticle

11 Citations (Scopus)

Abstract

Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

Original languageEnglish
Pages (from-to)207-219
Number of pages13
JournalLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume2820
Publication statusPublished - 2003 Dec 1

Fingerprint

Intrusion detection
Intrusion Detection
Hidden Markov models
False Positive
Markov Model
Error Rate
Model-based
Audit
Multiple Models
Experimental Results
Model

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

@article{5b802a19a9bc4e5da067bf3e0ecce1f7,
title = "Two sophisticated techniques to improve HMM-based intrusion detection systems",
abstract = "Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.",
author = "Sung-Bae Cho and Han, {Sang Jun}",
year = "2003",
month = "12",
day = "1",
language = "English",
volume = "2820",
pages = "207--219",
journal = "Lecture Notes in Computer Science",
issn = "0302-9743",
publisher = "Springer Verlag",

}

TY - JOUR

T1 - Two sophisticated techniques to improve HMM-based intrusion detection systems

AU - Cho, Sung-Bae

AU - Han, Sang Jun

PY - 2003/12/1

Y1 - 2003/12/1

N2 - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

AB - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

UR - http://www.scopus.com/inward/record.url?scp=21144432658&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=21144432658&partnerID=8YFLogxK

M3 - Article

VL - 2820

SP - 207

EP - 219

JO - Lecture Notes in Computer Science

JF - Lecture Notes in Computer Science

SN - 0302-9743

ER -