Abstract
Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.
| Original language | English |
|---|---|
| Pages (from-to) | 207-219 |
| Number of pages | 13 |
| Journal | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
| Volume | 2820 |
| Publication status | Published - 2003 Dec 1 |
Fingerprint
All Science Journal Classification (ASJC) codes
- Theoretical Computer Science
- Computer Science(all)
Cite this
}
Two sophisticated techniques to improve HMM-based intrusion detection systems. / Cho, Sung-Bae; Han, Sang Jun.
In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 2820, 01.12.2003, p. 207-219.Research output: Contribution to journal › Article
TY - JOUR
T1 - Two sophisticated techniques to improve HMM-based intrusion detection systems
AU - Cho, Sung-Bae
AU - Han, Sang Jun
PY - 2003/12/1
Y1 - 2003/12/1
N2 - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.
AB - Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.
UR - http://www.scopus.com/inward/record.url?scp=21144432658&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=21144432658&partnerID=8YFLogxK
M3 - Article
AN - SCOPUS:21144432658
VL - 2820
SP - 207
EP - 219
JO - Lecture Notes in Computer Science
JF - Lecture Notes in Computer Science
SN - 0302-9743
ER -