|
Published Articles >> Table of Contents >> Abstract
Second International Conference on Cyberworlds (CW'03)
p. 486
Utilizing Statistical Characteristics of N-grams for Intrusion Detection
Li Zhuowei, Nanyang Technological University
Amitabha Das, Nanyang Technological University
Sukumar Nandi, Nanyang Technological University
Full Article Text:
  
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CYBER.2003.1253494
Send link to a friend
| Abstract |
|
Information and infrastructure security is a serious issue of global concern. As the last line of defense for security infrastructure, intrusion detection techniques are paid more and more attention. In this paper, one anomaly-based intrusion detection technique (ScanAID: Statistical ChAracteristics of N-grams for Anomaly-based Intrusion Detection) is proposed to detect intrusive behaviors in a computer system. The statistical properties in sequences of system calls are abstracted to model the normal behaviors of a privileged process, in which the model is characterized by a vector of anomaly values of N-grams. With a reasonable definition of efficiency parameter, the length of an N-gram and the size of the training dataset are optimized to get an efficient and compact model. Then, with the optimal modeling parameters, the flexibility and efficiency of the model are evaluated by the ROC curves. Our experimental results show that the proposed statistical anomaly detection technique is promising and deserves further research (such as applying it to network environments).
|
 Additional Information
|
Citation:
Li Zhuowei, Amitabha Das, Sukumar Nandi,
"Utilizing Statistical Characteristics of N-grams for Intrusion Detection,"
cw,
p. 486,
Second International Conference on Cyberworlds (CW'03),
2003
|
|
