TY - GEN
T1 - Behavior analysis-based learning framework for host level intrusion detection
AU - Haiyan, Qiao
AU - Jianfeng, Peng
AU - Chuan, Feng
AU - Rozenblit, Jerzy W.
PY - 2007
Y1 - 2007
N2 - Machine learning has great utility within the context of network intrusion detection systems. In this paper, a behavior analysis-based learning framework for host level network intrusion detection is proposed, consisting of two parts, anomaly detection and alert verification. The anomaly detection module processes unlabeled data using a clustering algorithm to detect abnormal behaviors. The alert verification module adopts a novel rule learning based mechanism which analyzes the change of system behavior caused by an intrusion to determine whether an attack succeeded and therefore lower the number of false alarms. In this framework, the host behavior is not represented by a single user or program activity; instead, it is represented by a set of factors, called behavior set, so that the host behavior can be described more accurately and completely.
AB - Machine learning has great utility within the context of network intrusion detection systems. In this paper, a behavior analysis-based learning framework for host level network intrusion detection is proposed, consisting of two parts, anomaly detection and alert verification. The anomaly detection module processes unlabeled data using a clustering algorithm to detect abnormal behaviors. The alert verification module adopts a novel rule learning based mechanism which analyzes the change of system behavior caused by an intrusion to determine whether an attack succeeded and therefore lower the number of false alarms. In this framework, the host behavior is not represented by a single user or program activity; instead, it is represented by a set of factors, called behavior set, so that the host behavior can be described more accurately and completely.
UR - http://www.scopus.com/inward/record.url?scp=34250160945&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=34250160945&partnerID=8YFLogxK
U2 - 10.1109/ECBS.2007.23
DO - 10.1109/ECBS.2007.23
M3 - Conference contribution
AN - SCOPUS:34250160945
SN - 0769527728
SN - 9780769527727
T3 - Proceedings of the International Symposium and Workshop on Engineering of Computer Based Systems
SP - 441
EP - 447
BT - Proceedings - 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, ECBS 2007
T2 - 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, ECBS 2007
Y2 - 26 March 2007 through 29 March 2007
ER -