Two sophisticated techniques to improve HMM-based intrusion detection systems

Sung Bae Cho, Sang Jun Han

Research output: Chapter in Book/Report/Conference proceedingChapter

11 Citations (Scopus)

Abstract

Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
EditorsGiovanni Vigna, Christopher Kruegel, Erland Jonsson, Christopher Kruegel
PublisherSpringer Verlag
Pages207-219
Number of pages13
ISBN (Print)3540408789, 9783540408789
DOIs
Publication statusPublished - 2003

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume2820
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Two sophisticated techniques to improve HMM-based intrusion detection systems'. Together they form a unique fingerprint.

  • Cite this

    Cho, S. B., & Han, S. J. (2003). Two sophisticated techniques to improve HMM-based intrusion detection systems. In G. Vigna, C. Kruegel, E. Jonsson, & C. Kruegel (Eds.), Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (pp. 207-219). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 2820). Springer Verlag. https://doi.org/10.1007/978-3-540-45248-5_12