Re-evaluation of combined Markov-Bayes models for host intrusion detection on the ADFA dataset

This work investigates the performance of combined Markov-Bayes probabilistic models for host intrusion detection on the ADFA windows dataset (ADFA-WD) recently published in 2013. This dataset provides a new baseline against which modern host intrusion detection systems (HIDS) can be evaluated. Therefore, we evaluate the performance of SC2.2, a combined first order Markov-Bayes model that proved its performance against the anachronous 2004 UNM dataset, and show that this classifier performs passably on ADFA-WD, which led us to the exploration of other solutions contingent on the results provided by SC2.2 learning curves. We then evaluate the performance of (i) combined High order Markov-Bayes models and (ii) an ensemble of four first-order Markov-Bayes models. The results show that both classifiers drastically improve false alarm rate compared to SC2.2, while maintaining approximately the same detection rate when a per-process approach is used. We further show that under a whole-system approach, not only both techniques improve the false alarm rate, but also achieve a perfect detection rate.