Portal de Periódicos da CAPES

Intrusion Detection System Using Sequence and Set Preserving Metric

2005; Springer Science+Business Media; Linguagem: Inglês

10.1007/11427995_49

1611-3349

Pradeep Kumar, M. Venkateshwara Rao, P. Radha Krishna, Raju S. Bapi, Arijit Laha,

Spam and Phishing Detection

Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. In this paper we investigate the use of sequences of system calls for classifying intrusions and faults induced by privileged processes in Unix Operating system. In our work we applied sequence-data mining approach in the context of intrusion detection system (IDS). This paper introduces a new similarity measure that considers both sequence as well as set similarity among sessions. Considering both order of occurrences as well as content in a session enhances the capabilities of kNN classifier significantly, especially in the context of intrusion detection. From our experiments on DARPA 1998 IDS dataset we infer that the order of occurrences plays a major role in determining the nature of the session. The objective of this work is to construct concise and accurate classifiers to detect anomalies based on sequence as well as set similarity.