Visualizing and Identifying Intrusion Context from System Calls Trace

9 years 6 months ago
Visualizing and Identifying Intrusion Context from System Calls Trace
Anomaly-based Intrusion Detection (AID) techniques are useful for detecting novel intrusions without known signatures. However, AID techniques suffer from higher false alarm rate compared to signature-based intrusion detection techniques. In this paper, the concept of intrusion context identification is introduced to address the problem. The identification of the intrusion context can help to significantly enhance the detection rate and lower the false alarm rate of AID techniques. To evaluate the effectiveness of the concept, a simple but representative scheme for intrusion context identification is proposed, in which the anomalies in the intrusive datasets are visualized first, and then the intrusion contexts are identified from the visualized anomalies. The experimental results show that using the scheme, the intrusion contexts can be visualized and extracted from the audit trails correctly. In addition, as an application of the visualized anomalies, an implicit design drawback in ...
Zhuowei Li, Amitabha Das
Added 20 Aug 2010
Updated 20 Aug 2010
Type Conference
Year 2004
Authors Zhuowei Li, Amitabha Das
Comments (0)