Movatterモバイル変換


[0]ホーム

URL:


Skip to main content

Advertisement

Springer Nature Link
Log in

A Novel Anomaly Detection Using Small Training Sets

  • Conference paper

Part of the book series:Lecture Notes in Computer Science ((LNISA,volume 3578))

  • 1373Accesses

Abstract

Anomaly detection is an essential component of the protection mechanism against novel attacks.Traditional methods need very large volume of purely training dataset, which is expensive to classify it manually. A new method for anomaly intrusion detection is proposed based on supervised clustering and markov chain model, which is designed to train from a small set of normal data. After short system call sequences are clustered, markov chain is used to learn the relationship among these clusters and classify the normal or abnormal. The observed behavior of the system is analyzed to infer the probability that the markov chain of the norm profile supports the observed behavior. markov information source entropy and condition entropy are used to select parameters. The experiments have showed that the method is effective to detect anomalistic behaviors, and enjoys better generalization ability when a small number of training dataset is used only.

This is a preview of subscription content,log in via an institution to check access.

Access this chapter

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Similar content being viewed by others

References

  1. Warrender, C., Forrest, S., Pearlmutter, B.: Detecting Intrusion Using System Calls: Alternative Data Models. In: IEEE Symposium on Security and Privacy (May 1999)

    Google Scholar 

  2. Lane, T., Brodley, C.E.: Temporal sequence learning and data reduction for anomaly detection. ACM Transactions on Information and System Security 2, 295–331 (1999)

    Article  Google Scholar 

  3. Lee, W., Dong, X.: Information-Theoretic measures for anomaly detection. In: Proceedings of the 2001 IEEE Symposium on Security and Privacy, Oakland, CA, pp. 130–143 (2001)

    Google Scholar 

  4. Mukkamala, S., Janowski, G., Sung, A.H.: Intrusion Detection Using Neural Networks and Support Vector Machines. In: Proceedings of IEEE IJCNN, pp. 1702–1707 (2002)

    Google Scholar 

  5. Mukkamala, S., Janoski, G.I., Sung, A.H.: Intrusion Detection Using Support Vector Machines. In: Proceedings of the High Performance Computing Symposium - HPC 2002, San Diego, April 2002, pp. 178–183 (2002)

    Google Scholar 

  6. Lihong, Y., Xiaocao, Z., Hao, H., Bing, M., Li, X.: Research of system call based intrusion detection. Acta Electronica Sinica 31, 1134–1137 (2003)

    Google Scholar 

  7. Shah, H., Undercoffer, J., Joshi, D.A.: Fuzzy Clustering for Intrusion Detection. In: Proceedings of the 12th IEEE International Conference on Fuzzy Systems (April 2003)

    Google Scholar 

  8. Yeung, D.-Y., Ding, Y.: Host-based intrusion detection using dynamic and static behavioral models. Pattern Recognition 36, 229–243 (2003)

    Article MATH  Google Scholar 

  9. Hu, W., Liao, Y., Rao Vemuri, V.: Robust Support Vector Machines for Anamoly Detection in Computer Security. In: International Conference on Machine Learning, Los Angeles, CA (July 2003)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. College Of Computer Science & Technology, Harbin Engineering University, Harbin, 150001, P.R. China

    Qingbo Yin, Liran Shen, Rubo Zhang & Xueyao Li

Authors
  1. Qingbo Yin

    You can also search for this author inPubMed Google Scholar

  2. Liran Shen

    You can also search for this author inPubMed Google Scholar

  3. Rubo Zhang

    You can also search for this author inPubMed Google Scholar

  4. Xueyao Li

    You can also search for this author inPubMed Google Scholar

Editor information

Editors and Affiliations

  1. School of Information Technology and Electrical Engineering, University of Queensland, 4072, Australia

    Marcus Gallagher

  2.  , POB 30031, FL 32503-1031, Pensacola

    James P. Hogan

  3. Faculty of Information Technology, Queensland University of Technology, Box 2434, Q 4001, Brisbane, Australia

    Frederic Maire

Rights and permissions

Copyright information

© 2005 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Yin, Q., Shen, L., Zhang, R., Li, X. (2005). A Novel Anomaly Detection Using Small Training Sets. In: Gallagher, M., Hogan, J.P., Maire, F. (eds) Intelligent Data Engineering and Automated Learning - IDEAL 2005. IDEAL 2005. Lecture Notes in Computer Science, vol 3578. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11508069_34

Download citation

Publish with us


[8]ページ先頭

©2009-2025 Movatter.jp