A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection

Abstract

ntrusion detection has now been widely accepted as an essential component in a decent security system. This is due to the fact that the task of preventing all attacks is impossible. Intrusion detection can detect malicious attacks that have penetrated preventative mechanisms such as firewalls, which can help provide damage assessment, response, deterrence, and prosecution support.Denning's pioneering work [1] has established the most fundamental principle that the majority of intrusion detection systems (IDSs) have followed. The principle is a hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. It is suggested that profiles are used to represent the behavior of subjects using statistical measures. IDSs can have several different classifications. An IDS can be classified as an HIDS (host-based IDS) and NIDS (network-based IDS) in terms of the target the IDS protects. Also, an IDS can be classified into misuse intrusion detection and anomaly intrusion detection according to whether the features of an intrusion are known or unknown in advance. The misuse IDS retrieves attacks' signatures and establishes a database for the collection. During the detection process, the IDS will retrieve a subject signature and search a match against the established signature database.An intrusion alert is triggered once a match is found. Such a mechanism is very effective in detecting a priori known attacks, but performs unsatisfactorily in detecting unknown attacks. Anomaly IDSs are promising in detecting unknown attacks. Based on Denning's principle, an anomaly IDS first builds a system's normal behavior profile and then compares operational system behavior against the nominal profile. If a significant deviation is found, an intrusion alert is triggered.While Denning's intrusion detection model is a host-based IDS, extensive research activities have been shifted to network-based IDSs. There are several factors behind this, summarized as follows: • Networking factor: With the rapid proliferation of Internet technology, overwhelming computing applications are network based. Many security problems are introduced from this environment such as denial of service (DoS) attacks and other security loopholes related to networking protocols.• Real-time and computing resource restraints: Ideally, intrusion can be detected as soon as it happens in order to minimize the potential damage. However, audit data collection and processing for detecting intrusion involve large amounts of computing resources. Therefore, a dedicated hardware and software IDS component is required to perform the task efficiently. Normally, a network-based IDS deduces intrusion from analyzing network packets. It is very effective in detecting DoS attempts originating outside the network. The majority AbstractExtensive research activities have been observed on network-based intrusion detection systems (IDSs). However, there are always some attacks that penetrate trafficprofiling-based network IDS...

Intrusion Detection Techniques in Cloud Computing: A Review

“…Anomaly detection is then conducted through the comparison of the associated probability derived from the sequence observed with a predefined threshold. In a hidden Markov model, the states are not observable but when a state is visited an observation is recorded that is a probabilistic function of the state [27]. In the cloud HMM have been employed for host-based IDS in [28].…”

C2Hunter: Detection and Mitigation of Covert Channels in Data Centers

“…Markov property refers to the memoryless property of a stochastic process [54,55]. Covert channel model is such a stochastic process that the next state depends only upon the current state and has nothing to do with the previous status.…”

Post-Attack Intrusion Detection using Log Files Analysis

“…[12]also used HMM for the fact that the process behavior has the feature of HMM, and program execution states can be taken as the hidden states in HMM. Because of the performance of HMM authors in [13] introduced a new approach where array of HMM were used for detection of anomalous behavior. authors of [14] proposed detection of intrusion in complete session whereas others were limited to only single application.…”