Behavioral Distance Measurement using Hidden Markov Models
Conference Proceeding Article
The behavioral distance between two processes is a measure of the deviation of their behaviors. Behavioral distance has been proposed for detecting the compromise of a process, by computing its behavioral distance from another process executed on the same input. Provided that the two processes are diverse and so unlikely to fall prey to the same attacks, an increase in behavioral distance might indicate the compromise of one of them. In this paper we propose a new approach to behavioral distance calculation using a new type of Hidden Markov Model. We also empirically evaluate the intrusion detection capability of our proposal when used to measure the distance between the system-call behaviors of diverse web servers. Our experiments show that it detects intrusions with substantially greater accuracy and with performance overhead comparable to that of prior proposals.
intrusion detection, anomaly detection, system call, behavioral distance
Information Security and Trust
Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings
City or Country
GAO, Debin; Reiter, Michael K.; and SONG, Dawn.
Behavioral Distance Measurement using Hidden Markov Models. (2006). Recent Advances in Intrusion Detection: 9th International Symposium, RAID 2006 Hamburg, Germany, September 20-22, 2006 Proceedings. 4219, 19-40. Research Collection School Of Information Systems.
Available at: http://ink.library.smu.edu.sg/sis_research/1244