research-article

Combining incremental Hidden Markov Model and Adaboost algorithm for anomaly intrusion detection

Authors:

Yi-Ming ChenAuthors Info & Claims

CSI-KDD '09: Proceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics

Pages 3 - 9

https://doi.org/10.1145/1599272.1599276

Published: 28 June 2009 Publication History

Abstract

Traditional Hidden Markov Model (HMM) has been successfully applied to anomaly intrusion detection. Incremental HMM (IHMM) further improves the training time of HMM. However, both HMM and IHMM still have the problem of high false positive rate. In this paper, we propose an Adaboost-IHMM to combine IHMM and adaboost for anomaly intrusion detection. As adaboost firstly uses many IHMMs to collectively classify samples then decides the results of samples' classifications, the Adaboost-IHMM can improve the accurate rate of classifications. Experimental results with Stide datasets show that the proposed method can significantly improve the false positive rate by 70% without decreasing detection rate. Besides, we also propose a method to adjust the normal profile for avoiding erroneous detection caused by changes of normal behavior. We perform with experiments with realistic datasets extracted from the use of popular browsers. Compared with traditional HMM method, our method can improve the training time by 90% to build a new normal profile.

References

[1]

Kaspersky Security Bulletin: Malware Evolution 2008. http://www.viruslist.com/en/analysis?, Accessed on March 02, 2009.

[2]

Yongzhong Li, Yang Ge, Xu Jing, Zhao Bo. A new intrusion detection method based on fuzzy HMM. Industrial Electronics and Applications, 2008.

[3]

Rahul Khanna, Huaping Liu. Control theoretic approach to intrusion detection using a distributed hidden markov model. Wireless Communications, IEEE 2008.

Digital Library

[4]

Kjetil Haslum, Marie E. G. Moe and Svein J. Knapskog. Real-time intrusion prevention and security analysis of networks using HMMs. Local Computer Networks, 2008.

[5]

Kjetil Haslum, Ajith Abraham and Svein Knapskog. Fuzzy online risk assessment for distributed intrusion prediction and prevention systems. Computer Modeling and Simulation, 2008.

Digital Library

[6]

Chun Yang, Feiqi Deng, Haidong Yang. An unsupervised anomaly detection approach using subtractive clustering and hidden markov model. Communications and Networking in China, 2007.

[7]

C. Warrender, S. Forrest, B. Pearlmutter. Detecting intrusions using system calls: alternative data models. In Proceedings of the 1999 IEEE Symposium on Security and Privacy, pages 133--152, Oakland, California, 1999.

[8]

S. Cho, S. Han. Two sophisticated techniques to improve hmm-based intrusion detection systems. Proceedings of International Symposium on Recent Advances in Intrusion Detection, 2003.

[9]

German Florez-Larrahondo, Susan Bridges and Eric A. Hansen. Incremental estimation of discrete hidden markov models based on a new backward procedure. In Proceedings of the Twentieth National Conference on Artificial Intelligence, 2005.

Digital Library

[10]

Yoav Freund and Robert E. Schapire. A decision-theoretic generalization of on-line learning and an application to boosting. Journal of Computer and System Sciences 55, 119--139, 1997.

Digital Library

[11]

Yoav Freund and Robert E. Schapire. A short introduction to boosting. Journal of Japanese Society for Artificial Intelligence, 14(5):771--780, September, 1999.

[12]

Nikunj C. Oza and Stuart Russell. Online bagging and boosting. In Artificial Intelligence and Statistics 2001, Key West, FL, USA, pp. 105--112. January 2001.

[13]

Nikunj C. Oza. Online ensemble learning. Department of Electrical Engineering and Computer Science, University of California, Berkeley, 2001.

Digital Library

[14]

L. R. Rabiner, B. H. Juang. An introduction to hidden markov models. IEEE ASSP Magazine, January 1986.

[15]

L. R. Rabiner. A tutorial on hidden markov models and selected appli-cations in speech recognition. Proc. IEEE, vol. 77, pp. 257--286, Feb 1989.

[16]

Tom Bylander and Lisa Tate. Using validation sets to avoid overfitting in adaboost. American Association for Artificial Intelligence, 2006.

[17]

Alexander Vezhnevets and Olga Barinova. Avoiding boosting overfitting by removing confusing samples. Springer-Verlag Berlin Heidelberg 2007.

Digital Library

[18]

Weiming Hu, Wei Hu, and Steve Maybank. Adaboost-based algorithm for network intrusion detection. IEEE Transactions on Systems, Man, and Cybernetics---part B: Cybernetics, vol. 38, NO. 2, April 2008.

Digital Library

[19]

Say Wei Foo, Yong Lian, and Liang Dong. Recognition of visual speech elements using adaptively boosted hidden markov models. IEEE Transactions on Circuits and Systems for Video Technology, vol. 14, NO. 5, May 2004.

Digital Library

[20]

Levent M. Arslan, and John H. L. Hansen. Selective training for hidden markov models with applications to speech classification. IEEE Transactions on Speech and Audio Processing, vol. 7, NO. 1, January 1999.

[21]

UNM System Call Datasets. http://www.cs.unm.edu/~immsec/systemcalls.htm.

[22]

Xiao-Qung Zhang', Zhong-Llang Z H U. Combining the hmm and the neural network mqdels to recognize intrusions. Proceedings of the Third International Conference on Machine Laming and Cybernetics, Shanghai, 26--29 August 2004.

[23]

W. Wang, X. H. Guan, X. L. Zhang. Modeling program behaviors by hidden markov models for intrusion detection. In Proceedings of 2004 International Conference on Machine Learning and Cybernetics, Aug 2004.

[24]

E. Eskin, W. Lee, and S. J. Stolfo. Modeling system calls for intrusion detection with dynamic window sizes. In Proceedings of DARPA Information Survivability Conference&Exposition II, 2001. DISCEX'01, June 2001.

[25]

Wen-Fu Shin. An adaptive anomaly detection method based on incremental hidden markov model and windows native API. Department of Information Management, National Central University, Taiwan. Master thesis 2007. (in Chinese.)

Cited By

Xu LDing XZhao DLiu AZhang Z(2023)A Three-Dimensional ResNet and Transformer-Based Approach to Anomaly Detection in Multivariate Temporal–Spatial DataEntropy10.3390/e2502018025:2(180)Online publication date: 17-Jan-2023
https://doi.org/10.3390/e25020180
Cox LCox L(2023)Addressing Wicked Problems and Deep Uncertainties in Risk AnalysisAI-ML for Decision and Risk Analysis10.1007/978-3-031-32013-2_7(215-249)Online publication date: 6-Jul-2023
https://doi.org/10.1007/978-3-031-32013-2_7
Demertzis KIliadis LPimenidis ETziritas NKoziri MKikiras P(2021)Blockchained Adaptive Federated Auto MetaLearning BigData and DevOps CyberSecurity Architecture in Industry 4.0Proceedings of the 22nd Engineering Applications of Neural Networks Conference10.1007/978-3-030-80568-5_29(345-363)Online publication date: 1-Jul-2021
https://doi.org/10.1007/978-3-030-80568-5_29
Show More Cited By

Index Terms

Combining incremental Hidden Markov Model and Adaboost algorithm for anomaly intrusion detection
1. Security and privacy
  1. Systems security
    1. Operating systems security

Recommendations

Intrusion Detection Method Based on Fuzzy Hidden Markov Model
FSKD '09: Proceedings of the 2009 Sixth International Conference on Fuzzy Systems and Knowledge Discovery - Volume 03

Because of the excellent performance of the HMM (Hidden Markov Model), it has been widely used in pattern recognition. Due to the high false alarm rate in the classical intrusion detection system(IDS) based on HMM, a fuzzy approach for the HMM, called ...
Intrusion detection method based on fuzzy hidden Markov model
FSKD'09: Proceedings of the 6th international conference on Fuzzy systems and knowledge discovery - Volume 3

Because of the excellent performance of the HMM (Hidden Markov Model), it has been widely used in pattern recognition. Due to the high false alarm rate in the classical intrusion detection system(IDS) based on HMM, a fuzzy approach for the HMM, called ...
A program-based anomaly intrusion detection scheme using multiple detection engines and fuzzy inference

In this paper, a hybrid anomaly intrusion detection scheme using program system calls is proposed. In this scheme, a hidden Markov model (HMM) detection engine and a normal database detection engine have been combined to utilise their respective ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CSI-KDD '09: Proceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics

June 2009

94 pages

ISBN:9781605586694

DOI:10.1145/1599272

Editors:
Hsinchun Chen
The University of Arizona, Tucson
,
Marc Dacier
Symantec Research Labs Europe, France
,
Marie-Francine Moens
K.U. Leuven, Belgium
,
Gerhard Paass
Fraunhofer IAIS, St. Augustin, Germany
,
Christopher C. Yang
Drexel University, Philadelphia

Copyright © 2009 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 28 June 2009

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

National Science Council Taiwan

Conference

KDD09

Sponsor:

KDD09: The 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

June 28, 2009

Paris, France

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

18
Total Citations
View Citations
675
Total Downloads

Downloads (Last 12 months)5
Downloads (Last 6 weeks)1

Reflects downloads up to 30 Aug 2024

Other Metrics

View Author Metrics

Citations

Cited By

Xu LDing XZhao DLiu AZhang Z(2023)A Three-Dimensional ResNet and Transformer-Based Approach to Anomaly Detection in Multivariate Temporal–Spatial DataEntropy10.3390/e2502018025:2(180)Online publication date: 17-Jan-2023
https://doi.org/10.3390/e25020180
Cox LCox L(2023)Addressing Wicked Problems and Deep Uncertainties in Risk AnalysisAI-ML for Decision and Risk Analysis10.1007/978-3-031-32013-2_7(215-249)Online publication date: 6-Jul-2023
https://doi.org/10.1007/978-3-031-32013-2_7
Demertzis KIliadis LPimenidis ETziritas NKoziri MKikiras P(2021)Blockchained Adaptive Federated Auto MetaLearning BigData and DevOps CyberSecurity Architecture in Industry 4.0Proceedings of the 22nd Engineering Applications of Neural Networks Conference10.1007/978-3-030-80568-5_29(345-363)Online publication date: 1-Jul-2021
https://doi.org/10.1007/978-3-030-80568-5_29
Tripathi ABaruah R(2019)Anomaly Detection in Multivariate Time Series Using Fuzzy AdaBoost and Dynamic Naive Bayesian Classifier2019 IEEE International Conference on Systems, Man and Cybernetics (SMC)10.1109/SMC.2019.8914477(1938-1944)Online publication date: 6-Oct-2019
https://dl.acm.org/doi/10.1109/SMC.2019.8914477
Nagaraja AKumar TBayat OAljawarneh S(2018)An Extensive Survey on Intrusion Detection- Past, Present, FutureProceedings of the Fourth International Conference on Engineering & MIS 201810.1145/3234698.3234743(1-9)Online publication date: 19-Jun-2018
https://dl.acm.org/doi/10.1145/3234698.3234743
Islam MKhreich WHamou-Lhadj A(2018)Anomaly Detection Techniques Based on Kappa-Pruned EnsemblesIEEE Transactions on Reliability10.1109/TR.2017.278713867:1(212-229)Online publication date: Mar-2018
https://doi.org/10.1109/TR.2017.2787138
Raghavan ADi Troia FStamp M(2018)Hidden Markov models with random restarts versus boosting for malware detectionJournal of Computer Virology and Hacking Techniques10.1007/s11416-018-0322-115:2(97-107)Online publication date: 28-Aug-2018
https://doi.org/10.1007/s11416-018-0322-1
Bansal AKaur S(2018)Extreme Gradient Boosting Based Tuning for Classification in Intrusion Detection SystemsAdvances in Computing and Data Sciences10.1007/978-981-13-1810-8_37(372-380)Online publication date: 31-Oct-2018
https://doi.org/10.1007/978-981-13-1810-8_37
Ahmadian Ramaki ARasoolzadegan AJavan Jafari A(2018)A systematic review on intrusion detection based on the Hidden Markov ModelStatistical Analysis and Data Mining10.1002/sam.1137711:3(111-134)Online publication date: 15-May-2018
https://dl.acm.org/doi/10.1002/sam.11377
Soudi AKhreich WHamou-Lhadj A(2015)An Anomaly Detection System Based on Ensemble of Detectors with Effective Pruning TechniquesProceedings of the 2015 IEEE International Conference on Software Quality, Reliability and Security10.1109/QRS.2015.25(109-118)Online publication date: 3-Aug-2015
https://dl.acm.org/doi/10.1109/QRS.2015.25
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents