Applications of hidden Markov models to detecting multi-stage network attacks

@inproceedings{citeulike:363242, abstract = {This paper describes an approach using hidden Markov models (HMM) to detect complex Internet attacks. These attacks consist of several steps that may occur over an extended period of time. Within each step, specific actions may be interchangeable. A perpetrator may deliberately use a choice of actions within a step to mask the intrusion. In other cases, alternate action sequences may be random (due to noise) or because of lack of experience on the part of the perpetrator. For an intrusion detection system to be effective against complex Internet attacks, it must be capable of dealing with the ambiguities described above. We describe research results concerning the use of HMMs as a defense against complex Internet attacks. We describe why HMMs are particularly useful when there is an order to the actions constituting the attack (that is, for the case where one action must precede or follow another action in order to be effective). Because of this property, we show that HMMs are well suited to address the multi-step attack problem. In a direct comparison with two other classic machine learning techniques, decision trees and neural nets, we show that HMMs perform generally better than decision trees and substantially better than neural networks in detecting these complex intrusions.}, author = {Ourston, D. and Matzner, S. and Stump, W. and Hopkins, B. }, citeulike-article-id = {365130}, journal = {System Sciences, 2003. Proceedings of the 36th Annual Hawaii International Conference on}, keywords = {intrusion\_detection, markov}, posted-at = {2005-10-26 05:16:10}, priority = {2}, title = {Applications of hidden Markov models to detecting multi-stage network attacks}, url = {http://ieeexplore.ieee.org/xpls/abs\_all.jsp?arnumber=1174909}, year = {2003} }

TY - CONF ID - citeulike:363242 L3 - citeulike-article-id:365130 N2 - This paper describes an approach using hidden Markov models (HMM) to detect complex Internet attacks. These attacks consist of several steps that may occur over an extended period of time. Within each step, specific actions may be interchangeable. A perpetrator may deliberately use a choice of actions within a step to mask the intrusion. In other cases, alternate action sequences may be random (due to noise) or because of lack of experience on the part of the perpetrator. For an intrusion detection system to be effective against complex Internet attacks, it must be capable of dealing with the ambiguities described above. We describe research results concerning the use of HMMs as a defense against complex Internet attacks. We describe why HMMs are particularly useful when there is an order to the actions constituting the attack (that is, for the case where one action must precede or follow another action in order to be effective). Because of this property, we show that HMMs are well suited to address the multi-step attack problem. In a direct comparison with two other classic machine learning techniques, decision trees and neural nets, we show that HMMs perform generally better than decision trees and substantially better than neural networks in detecting these complex intrusions. JF - System Sciences, 2003. Proceedings of the 36th Annual Hawaii International Conference on TI - Applications of hidden Markov models to detecting multi-stage network attacks KW - intrusion_detection KW - markov AU - Ourston, D AU - Matzner, S AU - Stump, W AU - Hopkins, B PY - 2003/// UR - http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1174909 ER -