Skip to Main Content
In this paper we discuss our research in developing anomaly detecting method for intrusion detection. The key idea is to use HMMs (Hidden Markov models) to learn the (normal and abnormal) patterns of Unix processes. These patterns can be used to detect anomalies and known intrusion. Using experiments on the mail-sending system call data, we demonstrate that we can construct concise and accurate classifiers to detect intrusion action.
Machine Learning and Cybernetics, 2002. Proceedings. 2002 International Conference on (Volume:1 )
Date of Conference: 2002