Use of K-Nearest Neighbor classifier for intrusion detection
Computers & SecurityPublished 17 September 2002
Yi‐Hua Liao, V. Rao Vemuri
Citations799
SJR quartileQ1
SJR score1.45
SNIP2.27
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive, and seems to offer some computational advantages over those that seek to characterize program behavior with short sequences of system calls and generate individual program profiles.
Abstract
A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive. Program behavior, in turn, is represented by frequencies of system calls. Each system call is treated as a word and the collection of system calls over each program execution as a document. These documents are then classified using kNN classifier, a popular method in text categorization. This method seems to offer some computational advantages over those that seek to characterize program behavior with short sequences of system calls and generate individual program profiles. Preliminary experiments with 1998 DARPA BSM audit data show that the kNN classifier can effectively detect intrusive attacks and achieve a low false positive rate.
Keywords
Computer Science
Detecting intrusions using system calls: alternative data models
1,107 Citations2003C. Warrender, Stephanie Forrest +1 more
This work compares the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions and concludes that for this particular problem, weaker methods than HMMs are likely sufficient.
Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
899 Citations2002Richard P. Lippmann, David J. Fried +9 more
An intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100's of users on 1000's of hosts and the best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users.
Communications of the ACMComputer immunology
853 Citations1997Stephanie Forrest, Steven Hofmeyr +1 more
Improvements can be achieved by designing computer immune systems with some of the important properties of natural immune systems, including multilayered protection; highly distributed detector, effector, and memory systems; diversity of detection ability across individuals; inexact matching strategies; and sensitivity to most new foreign patterns.
A sense of self for Unix processes
838 Citations2002Stephanie Forrest, Steven Hofmeyr +2 more
A method for anomaly detection is introduced in which "normal" is defined by short-range correlations in a process' system calls, and initial experiments suggest that the definition is stable during normal behaviour for standard UNIX programs.
Intrusion Detection Systems: A Survey and Taxonomy
758 Citations2002Stefan Axelsson
The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such, which are used predictively to survey and classify a number of research prototypes.
ACM Transactions on Information and System SecurityThe base-rate fallacy and the difficulty of intrusion detection
607 Citations2000Stefan Axelsson
There are indications that at least some types of intrusion detection have far to go before they can attain such low false alarm rates, due to the base-rate fallacy phenomenon.
ScienceGauging Similarity with <i>n</i> -Grams: Language-Independent Categorization of Text
535 Citations1995Marc Damashek
A language-independent means of gauging topical similarity in unrestricted text by combining information derived from n-grams with a simple vector-space technique that makes sorting, categorization, and retrieval feasible in a large multilingual collection of documents.
Learning program behavior profiles for intrusion detection
401 Citations1999A. K. Ghosh, Aaron Schwartzbard +1 more
Three anomaly detection techniques for prooling program behavior that evolve from memorization to generalization are presented, which start from a simple equality matching algorithm for determining anomalous behavior, and evolve to a feed-forward backpropagation neural network for learning program behavior.
A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems
380 Citations1999K. R. Kendall
The focus of this thesis is the attacks that were developed for use in the 1998 DARPA intrusion detection evaluation and included older, well-known attacks, newer attacks that have recently been released to publicly available forums, and some novel attacks developed specifically for this evaluation.
Columbia Academic Commons (Columbia University)Learning Patterns from Unix Process Execution Traces for Intrusion Detection
271 Citations1997Wenke Lee, Saivatore J. Stolfo +1 more
The preliminary experiments to extend the work pioneered by Forrest on learning the (normal abnormal) patterns of Unix processes can be used to identify misuses of and intrusions in Unix systems indicate that machine learning can play an important role by generalizing stored sequence information to perhaps provide broader intrusion detection services.
IEEE Transactions on Systems Man and Cybernetics - Part A Systems and HumansProbabilistic techniques for intrusion detection based on computer audit data
221 Citations2001Nong Ye, Xiang‐Yang Li +3 more
Unless the scalability problem of complex data models taking into account the ordering property of activity data is solved, intrusion detection techniques based on the frequency property provide a viable solution that produces good intrusion detection performance with low computational overhead.
Automated detection of vulnerabilities in privileged programs by execution monitoring
209 Citations2002Calvin Ko, G. Fink +1 more
By tightly restricting the behavior of all privileged programs, exploitations of unknown vulnerabilities can be detected by monitoring their execution using audit trails, and a program policy specification language is described, which is based on simple predicate logic and regular expressions.
Expert Network: Effective and Efficient Learning from Human Decisions in Text Categorization and Retrieval
187 Citations1994Yiming Yang
The simplicity of the model, the high recall-precision rates, and the efficient computation together make ExpNet preferable as a practical solution for real-world applications.
Automated Text Categorization Using Support Vector Machine.
125 Citations1998James T. Kwok
SVM adapts eeciently in dynamic environments that require frequent additions to the document collection, and allows easy incorporation of new documents into an existing trained system.
A new intrusion detection method based on discriminant analysis
33 Citations2001Midori Asaka, Takefumi Onabuta +3 more
A new method based on the number of system calls during a user’s network activity on a host machine is investigated, which attempts to separate intrusions from normal activities by using discriminant analysis, a kind of multivariate analysis.