Using Text Categorization Techniques for Intrusion Detection

摘要: A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive. Short sequences of system calls have been by others characterize a program’s before. However, separate databases short call be built for different programs, and learning profiles involves time-consuming training testing processes. With kNN frequencies are describe behavior. Text categorization techniques adopted convert each process vector calculate similarity between two activities. Since there no need learn individual separately, calculation involved largely reduced. Preliminary experiments with 1998 DARPA BSM audit data show that classifier can effectively detect intrusive attacks achieve low false positive rate.