Service Discrimination and Audit File Reduction for Effective Intrusion Detection

Godínez, Fernando; Hutter, Dieter; Monroy, Raúl

doi:10.1007/978-3-540-31815-6_9

Cited by 1 publication

(6 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The reason for time reduction is that the order of the HMMs training algorithm is O(n 2 l), where n is the number of states in the HMM, and l is length of the training sequence. In figure 2 we show training times for the HMMs presented in [4]. In each figure, training times for unfolded sessions and its folded counterpart are [4].…”

Section: Validation Resultsmentioning

confidence: 99%

“…All these n-grams have an associated occurrence count, and the total number of system calls present in the original log file. The n-gram set used in the folding process and the dictionary are available at our web site 4 . Along with the size of the n-grams, the number of system calls will define the reduction ratio.…”

Section: Fig 1 Mixed Services and Telnet Histogramsmentioning

confidence: 99%

“…To prove this, we compared the service selection results described in [4] using folded sessions against the results of unfolded sessions. We also used this comparison to show the HMM training time difference between folded and unfolded sessions.…”

Section: Validation Experiments and Data Selectionmentioning

confidence: 99%

“…The length of the sequence can vary depending on the activity of the user, it can be as short as a few hundred system calls, or as large as tens of thousand system calls. We have used HMMs both to, classify the service a session belongs to [4], and to detect intrusions. Time complexity for training and parsing of an HMM is directly related to the length of the sequence they ought to analyse.…”

Section: Introductionmentioning

confidence: 99%

“…The remainder of this paper is organised as follows: §2 is an overview of other attempts at log file reduction; §3 presents the reason to chose n-grams over other feature extraction methods like HMMs; §4 gives a brief overview of how and why we chose data for identifying repetitive n-grams; §5 shows the use of the n-gram models to identify the n-grams with higher occurrence frequency; §6 summarises the reduct obtained throughout our investigations; §7 is a description of our validation experiments and the selected data for such experiments; §8 shows the results obtained from applying the validation experiments to a collection of BSM log files and to the service selection module [4]; §9 shows the impact of our methodology on intrusion detection; finally, conclusions drawn up from our investigations appear in §10.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

On the Role of Information Compaction to Intrusion Detection

Godínez

Hutter²,

Monroy

2005

Advanced Distributed Systems

Self Cite

View full text Add to dashboard Cite

Abstract. An intrusion detection system (IDS) usually has to analyse Giga-bytes of audit information. In the case of anomaly IDS, the information is used to build a user profile characterising normal behaviour. Whereas for misuse IDSs, it is used to test against known attacks. Probabilistic methods, e.g. hidden Markov models, have proved to be suitable to profile formation but are prohibitively expensive. To bring these methods into practise, this paper aims to reduce the audit information by folding up subsequences that commonly occur within it. Using n-grams language models, we have been able to successfully identify the n-grams that appear most frequently. The main contribution of this paper is a n-gram extraction and identification process that significantly reduces an input log file keeping key information for intrusion detection. We reduced log files by a factor of 3.6 in the worst case and 4.8 in the best case. We also tested reduced data using hidden Markov models (HMMs) for intrusion detection. The time needed to train the HMMs is greatly reduced by using our reduced log files, but most importantly, the impact on both the detection and false positive ratios are negligible.

show abstract

Section: Validation Resultsmentioning

confidence: 99%

Section: Fig 1 Mixed Services and Telnet Histogramsmentioning

confidence: 99%

Section: Validation Experiments and Data Selectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations