Two sophisticated techniques to improve HMM-based intrusion detection systems

Sung Bae Cho; Sang Jun Han

doi:10.1007/978-3-540-45248-5_12

Two sophisticated techniques to improve HMM-based intrusion detection systems

Sung Bae Cho, Sang Jun Han

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Chapter

11 Citations (Scopus)

Abstract

Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

Original language	English
Title of host publication	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Editors	Giovanni Vigna, Christopher Kruegel, Erland Jonsson, Christopher Kruegel
Publisher	Springer Verlag
Pages	207-219
Number of pages	13
ISBN (Print)	3540408789, 9783540408789
DOIs	https://doi.org/10.1007/978-3-540-45248-5_12
Publication status	Published - 2003

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	2820
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

All Science Journal Classification (ASJC) codes

Theoretical Computer Science
Computer Science(all)

Access to Document

10.1007/978-3-540-45248-5_12

Fingerprint Dive into the research topics of 'Two sophisticated techniques to improve HMM-based intrusion detection systems'. Together they form a unique fingerprint.

Cite this

Cho, S. B., & Han, S. J. (2003). Two sophisticated techniques to improve HMM-based intrusion detection systems. In G. Vigna, C. Kruegel, E. Jonsson, & C. Kruegel (Eds.), Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (pp. 207-219). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 2820). Springer Verlag. https://doi.org/10.1007/978-3-540-45248-5_12

Cho, Sung Bae ; Han, Sang Jun. / Two sophisticated techniques to improve HMM-based intrusion detection systems. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). editor / Giovanni Vigna ; Christopher Kruegel ; Erland Jonsson ; Christopher Kruegel. Springer Verlag, 2003. pp. 207-219 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inbook{5b802a19a9bc4e5da067bf3e0ecce1f7,

title = "Two sophisticated techniques to improve HMM-based intrusion detection systems",

abstract = "Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.",

author = "Cho, {Sung Bae} and Han, {Sang Jun}",

year = "2003",

doi = "10.1007/978-3-540-45248-5_12",

language = "English",

isbn = "3540408789",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "207--219",

editor = "Giovanni Vigna and Christopher Kruegel and Erland Jonsson and Christopher Kruegel",

booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

address = "Germany",

}

Cho, SB & Han, SJ 2003, Two sophisticated techniques to improve HMM-based intrusion detection systems. in G Vigna, C Kruegel, E Jonsson & C Kruegel (eds), Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 2820, Springer Verlag, pp. 207-219. https://doi.org/10.1007/978-3-540-45248-5_12

Two sophisticated techniques to improve HMM-based intrusion detection systems. / Cho, Sung Bae; Han, Sang Jun.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). ed. / Giovanni Vigna; Christopher Kruegel; Erland Jonsson; Christopher Kruegel. Springer Verlag, 2003. p. 207-219 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 2820).

Research output: Chapter in Book/Report/Conference proceeding › Chapter

TY - CHAP

T1 - Two sophisticated techniques to improve HMM-based intrusion detection systems

AU - Cho, Sung Bae

AU - Han, Sang Jun

PY - 2003

Y1 - 2003

N2 - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

AB - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

UR - http://www.scopus.com/inward/record.url?scp=21144432658&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=21144432658&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-45248-5_12

DO - 10.1007/978-3-540-45248-5_12

M3 - Chapter

AN - SCOPUS:21144432658

SN - 3540408789

SN - 9783540408789

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 207

EP - 219

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

A2 - Vigna, Giovanni

A2 - Kruegel, Christopher

A2 - Jonsson, Erland

A2 - Kruegel, Christopher

PB - Springer Verlag

ER -

Cho SB, Han SJ. Two sophisticated techniques to improve HMM-based intrusion detection systems. In Vigna G, Kruegel C, Jonsson E, Kruegel C, editors, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Springer Verlag. 2003. p. 207-219. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-540-45248-5_12