"Why 6?" Defining the operational limits of stide, an anomaly-based intrusion detector

Tan, Kymie; Maxion, Roy A.

doi:10.1109/secpri.2002.1004371

Cited by 84 publications

(62 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Other researchers, e.g. [9,10,8], have also explored the use of HMMs to intrusion detection, improving only slightly Warrender et al's results.…”

Section: Related Workmentioning

confidence: 99%

“…Tan and Maxion have shown that the size of the window, meaning the depth of the grammar, that Warrender et al is actually the minimal for an anomaly to be detected [8]. However, Wagner and Soto have disagreed with this result, demonstrating that a sliding window of size 6 is insufficient to detect a lot of mimicry attacks [1].…”

Section: Related Workmentioning

confidence: 99%

“…[7][8][9][10]. Roughly, an HMM is built for modelling sequences of system calls output by an ordinary system user.…”

Section: Hidden Markov Modelsmentioning

confidence: 99%

“…Tan and Maxion have found that 6 is the size of the smallest unique subsequence for the log files used by Forrest [8]. Thus, for any intrusion detection method to be effective, it must consider sequences of size 6 or larger; in symbols: Σ 2 ⊂ Σ 3 ⊂ Σ 4 ⊂ Σ 5 ⊂ Σ 6 and 6−gram ⊂ 7−gram.…”

Section: Word Networkmentioning

confidence: 99%

See 3 more Smart Citations

On the Use of Word Networks to Mimicry Attack Detection

Godínez

Hutter²,

Monroy

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Intrusion detection aims at raising an alarm any time the security of an IT system gets compromised. Though highly successful, Intrusion Detection Systems are all susceptible of mimicry attacks [1]. A mimicry attack is a variation of an attack that attempts to pass by as normal behaviour. In this paper, we introduce a method which is capable of successfuly detecting a significant and interesting sub-class of mimicry attacks. Our method makes use of a word network [2,3]. A word network conveniently decomposes a pattern matching problem into a chain of smaller, noise-tolerant pattern matchers, thereby making it more tractable. A word network is realised as a finite state machine, where every state is a hidden Markov model. Our mechanism has shown a 93% of effectivity, with a false positive rate of 3%.

show abstract

“…Other researchers, e.g. [9,10,8], have also explored the use of HMMs to intrusion detection, improving only slightly Warrender et al's results.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

“…[7][8][9][10]. Roughly, an HMM is built for modelling sequences of system calls output by an ordinary system user.…”

Section: Hidden Markov Modelsmentioning

confidence: 99%

Section: Word Networkmentioning

confidence: 99%

See 2 more Smart Citations

On the Use of Word Networks to Mimicry Attack Detection

Godínez

Hutter²,

Monroy

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…This detection method has been widely explored for the identification of malicious software. As explained in prior work [94,110], n-grams are particularly useful to model sequences of elements. The number associated to the "n" is the length of each examined sequence; the system receives labeled sequences and uses them to train a classifier in order to recognize from the sequences of an unknown sample to which label the sample should be assigned.…”

Section: History Leakage Detectionmentioning

confidence: 99%

Measurement and detection of security properties of client-side web applications

Weissbacher¹

View full text Add to dashboard Cite

Data Cleaning and Enriched Representations for Anomaly Detection in System Calls

Tandon¹,

Chan²,

Mitra

Advanced Information and Knowledge Processing

View full text Add to dashboard Cite

Computer security research has two major aspects: intrusion prevention and intrusion detection. While the former deals with preventing the occurrence of an attack (using authentication and encryption techniques), the latter focuses on the detection of successful breach of security. Together, these complementary approaches assist in creating a more secure system. Intrusion detection systems (IDSs) are generally categorized as misusebased and anomaly-based. In misuse (signature) detection, systems are modeled upon known attack patterns and the test data is checked for occurrence of these patterns. Examples of signature-based systems include virus detectors that use known virus signatures and alert the user when the system has been infected by the same virus. Such systems have a high degree of accuracy but suffer from the inability to detect novel attacks. Anomaly-based intrusion detection [199] models normal behavior of applications and significant deviations from this behavior are considered anomalous. Anomaly detection systems can detect novel attacks but also generate false alarms since not all anomalies are hostile. Intrusion detection systems can also be categorized as network-based, which monitors network traffic, and host-based, where operating system events are monitored.There are two focal issues that need to be addressed for a host-based anomaly detection system: cleaning the training data, and devising an enriched representation for the model(s). Both these issues try to improve the performance of an anomaly detection system in their own ways. First, all the proposed techniques that monitor system call sequences rely on clean training data to build their model. The current audit sequence is then examined for anomalous behavior using some supervised learning algorithm. An attack embedded inside the training data would result in an erroneous model, since all future occurrences of the attack would be treated as normal. Moreover, obtaining clean data by hand could be tedious. Purging all malicious content from audit data using an automated technique is hence imperative.

show abstract

"Why 6?" Defining the operational limits of stide, an anomaly-based intrusion detector

Cited by 84 publications

References 8 publications

On the Use of Word Networks to Mimicry Attack Detection

On the Use of Word Networks to Mimicry Attack Detection

Measurement and detection of security properties of client-side web applications

Data Cleaning and Enriched Representations for Anomaly Detection in System Calls

Contact Info

Product

Resources

About