Host intrusion detection using system call argument-based clustering combined with Bayesian classification

مقدم أطروحة جامعية

Koucham, Walid

مشرف أطروحة جامعية

Asim, Nasir
Rashidi, Taj al-Din

الجامعة

جامعة الأخوين

الكلية

كلية الهندسة و العلوم

القسم الأكاديمي

علوم الحاسب

دولة الجامعة

المغرب

الدرجة العلمية

ماجستير

تاريخ الدرجة العلمية

2014

الملخص الإنجليزي

We deal in this project with anomaly-based host intrusion detection using system call traces produced by a host's kernel.

Calls' arguments, together with contextual information and domain level knowledge are used, rst, to produce clusters for each individual system call.

These clusters are further used to rewrite process sequences of system calls obtained from kernel logs.

Results of clustering validation using the Silhouette width and validation are provided as well as a manual analysis of the produced clusters.

The new sequences are then fed to a nave Bayes supervised classi er (SC2.2) that builds class conditional probabilities from Markov modeling of system call sequences.

The results of our proposed two-stage (that is clustering followed by classi cation) intrusion detection system on the 1999 DARPA dataset from the MIT Lincoln Lab show signi cant performance improvements in terms of false positive rate (up to 20% improvements) , while maintaining a high detection rate when compared with other classi ers.

The two-stage classi er fares also better than bare classi cation with SC2.2 on system calls without arguments and contextual knowledge.

التخصصات الرئيسية

تكنولوجيا المعلومات وعلم الحاسوب

الموضوعات

• حماية البيانات
• الحواسيب
• شبكات الحاسوب
• الإجراءات الأمنية

عدد الصفحات

69

قائمة المحتويات

• APA
• MLA
• AMA

لغة النص

الإنجليزية

نوع البيانات

رسائل جامعية

رقم السجل

BIM-646384