TY - GEN
T1 - Effective intrusion type identification with edit distance for HMM-based anomaly detection system
AU - Koo, Ja Min
AU - Cho, Sung Bae
PY - 2005
Y1 - 2005
N2 - As computer security becomes important, various system security mechanisms have been developed. Especially anomaly detection using hidden Markov model has been actively exploited. However, it can only detect abnormal behaviors under predefined threshold, and it cannot identify the type of intrusions. This paper aims to identify the type of intrusions by analyzing the state sequences using Viterbi algorithm and calculating the distance between the standard state sequence of each intrusion type and the current state sequence. Because the state sequences are not always extracted consistently due to environmental factors, edit distance is utilized to measure the distance effectively. Experimental results with buffer overflow attacks show that it identifies the type of intrusions well with inconsistent state sequences.
AB - As computer security becomes important, various system security mechanisms have been developed. Especially anomaly detection using hidden Markov model has been actively exploited. However, it can only detect abnormal behaviors under predefined threshold, and it cannot identify the type of intrusions. This paper aims to identify the type of intrusions by analyzing the state sequences using Viterbi algorithm and calculating the distance between the standard state sequence of each intrusion type and the current state sequence. Because the state sequences are not always extracted consistently due to environmental factors, edit distance is utilized to measure the distance effectively. Experimental results with buffer overflow attacks show that it identifies the type of intrusions well with inconsistent state sequences.
UR - http://www.scopus.com/inward/record.url?scp=33646726579&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=33646726579&partnerID=8YFLogxK
U2 - 10.1007/11590316_30
DO - 10.1007/11590316_30
M3 - Conference contribution
AN - SCOPUS:33646726579
SN - 3540305068
SN - 9783540305064
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 222
EP - 228
BT - Pattern Recognition and Machine Intelligence - First International Conference, PReMI 2005, Proceedings
T2 - 1st International Conference on Pattern Recognition and Machine Intelligence, PReMI 2005
Y2 - 20 December 2005 through 22 December 2005
ER -