Sequence Covering for Efficient Host-Based Intrusion Detection

Abstract

This paper introduces a new similarity measure, the covering similarity, that we formally define for evaluating the similarity between a symbolic sequence and a set of symbolic sequences. A pair-wise similarity can also be directly derived from the covering similarity to compare two symbolic sequences. An efficient implementation to compute the covering similarity is proposed that uses a suffix-tree data-structure, but other implementations, based on suffix-array for instance, are possible and possibly necessary for handling very large-scale problems. We have used this similarity to isolate attack sequences from normal sequences in the scope of Host-based Intrusion Detection. We have assessed the covering similarity on two well-known benchmarks in the field. In view of the results reported on these two datasets for the state of the art methods, and according to the comparative study we have carried out based on three challenging similarity measures commonly used for string processing or in bioinformatics, we show that the covering similarity is particularly relevant to address the detection of anomalies in sequences of system calls.

Analyzing host security using D‐S evidence theory and multisource information fusion

“…Ye et al 37 used multivariable control technology to establish a norm for normal activities in an information system and then used the norm to detect anomalies and judge intrusion behaviors. Based on the suffix tree data structure, Marteau 38 and others proposed a method to measure the similarity of host intrusion behavior, which can isolate the attack sequence from the normal sequence within the host's intrusion detection range. Serpen et al 39 introduced a system design scheme for intrusion detection for the Linux operating system.…”

IMLADS: Intelligent Maintenance and Lightweight Anomaly Detection System for Internet of Things

“…The authors in Refs. [11,12] selected five types of features, including RAM usage, node network connections and usage of bandwidth etc., to perform anomaly detection. The experimental results verified by their method have good performance in node level anomaly detection.…”

DNS-ADVP: A Machine Learning Anomaly Detection and Visual Platform to Protect Top-Level Domain Name Servers Against DDoS Attacks

“…Host-based intrusion detection systems are an essential component of cybersecurity [16], [17]; however, our work is confined to the area of network-based detection systems, since our model is based only on network packets before they reach the authoritative DNS server.…”