Abstract
This paper addresses the taskof detecting intrusions in the form of malicious attacks on programs running on a host computer system by inspecting the trace of system calls made by these programs. We use ‘attack-tree’ type generative models for such intrusions to select features that are used by a Support Vector Machine Classifier. Our approach combines the ability of an HMM generative model to handle variable-length strings, i.e. the traces, and the non-asymptotic nature of Support Vector Machines that permits them to work well with small training sets.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
N. Cristianini, J. and Shawe-Taylor. An introduction to Support Vector Machines and other kernel-based learning methods. Cambridge University Press (2000)
R. Elliot, L. Aggoun, J., Moore. Hidden Markov Models, Estimation and Control, Springer-Verlag.
S. Hofmeyr, S. Forrest, A. Somayaji. Intrusion detection using sequences of system calls. Journal of Computer Security 6 (1998) 151–180
T. Jaakkola, and D. Haussler. Exploiting generative models in discriminative classifiers. Advances in Neural Information Processing Systems II, San Mateo, CA. Morgan Kauffmann Publishers.
T. Jaakkola, and D. Haussler. Using the Fisher Kernel method to detect remote protein homologies. Proceedings of the Seventh International Conference on Intelligent Systems for Molecular Biology (1999)
F. Jelinek. Statistical methods for Speech Recognition. MIT Press, (1999)
T. Joachims. SVMlight. http://svmlight.joachims.org/.
MIT Lincoln Labs, The 1999 DARPA Intrusion Detection evaluation data corpus. http://www.ll.mit.edu/IST/ideval
O. Sheyner, J. Haines, S. Jha, R. Lippmann, J. Wing, J. Automated generation and analysis of Attack Graphs. Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, (May 2002)
L. Rabiner. A tutorial on Hidden Markov Models and selected application in Speech Recognition. Proceedings of the IEEE, vol: 77, No: 2, (February 1989)
I. Rigoutsos and A. Floratos. Combinatorial pattern discovery in Biological sequences: the Teiresias algorithm. Bioinformatics, vol: 14, no:1, pages:55–67 (1998)
B. Schneier. Attack Trees. Dr. Dobb’s Journal, http://www.ddj.com/documents/s=896/ddj9912a/9912a.htm (December 1999)
V. Vapnik. Statistical Learning Theory. Wiley Inter-science. (1996)
A. Wespi, M. Dacier, H. Debar. Solutions périodiques, du An intrusion detection system based on the Teiresias pattern discovery algorithm. EICAR proceedings (1999)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2002 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Baras, J.S., Rabi, M. (2002). Intrusion Detection with Support Vector Machines and Generative Models. In: Chan, A.H., Gligor, V. (eds) Information Security. ISC 2002. Lecture Notes in Computer Science, vol 2433. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45811-5_3
Download citation
DOI: https://doi.org/10.1007/3-540-45811-5_3
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-44270-7
Online ISBN: 978-3-540-45811-1
eBook Packages: Springer Book Archive