HMMs for anomaly intrusion detection

摘要: Anomaly intrusion detection focuses on modeling normal behaviors and identifying significant deviations, which could be novel attacks. The existing techniques in that domain were analyzed, then an effective anomaly method based HMMs (Hidden Markov Models) was proposed to learn patterns of Unix processes. Fixed-length sequences system calls extracted from traces programs train test models. Both temporal orderings parameters taken into considered this method. RP (Relative Probability) value, used short as inputs, computed classify abnormal behaviors. algorithm is simple can directly applied. Experiments sendmail lpr demonstrate the construct accurate concise discriminator detect intrusive actions.