Zobrazit v EDS

A REAL-TIME INTRUSION DETECTION SYSTEM FOR THE WINDOWS ENVIRONMENT.

Uloženo v:
Podrobná bibliografie
Název: A REAL-TIME INTRUSION DETECTION SYSTEM FOR THE WINDOWS ENVIRONMENT.
Autoři: Buckley, Deborah1, Altas, Irfan1, Howarth, Jason1
Zdroj: Proceedings of the IADIS International Conference on WWW/Internet. Nov2007, p84-88. 5p. 1 Diagram, 1 Chart.
Témata: Intrusion detection systems (Computer security), Algorithms, Data mining, Windows (Graphical user interfaces), Online data processing
Abstrakt: This paper presents a prototype real-time intrusion detection system (IDS) for the Windows platform. It combines data mining and intrusion detection techniques to detect intrusions from sequences of native API calls. It analyses Windows native API calls in real-time using the probabilistic cover coefficient clustering algorithm. We intentionally used a simple, computationally-fast algorithm that is able to incorporate historical data into the detection process while still allowing the IDS to run in real-time. We demonstrate our prototype using artificial intrusion sequences. Although the test data produced a number of false positives, no false negatives were recorded. [ABSTRACT FROM AUTHOR]
Databáze: Supplemental Index
Popis
Abstrakt:This paper presents a prototype real-time intrusion detection system (IDS) for the Windows platform. It combines data mining and intrusion detection techniques to detect intrusions from sequences of native API calls. It analyses Windows native API calls in real-time using the probabilistic cover coefficient clustering algorithm. We intentionally used a simple, computationally-fast algorithm that is able to incorporate historical data into the detection process while still allowing the IDS to run in real-time. We demonstrate our prototype using artificial intrusion sequences. Although the test data produced a number of false positives, no false negatives were recorded. [ABSTRACT FROM AUTHOR]