Sequence Covering for Efficient Host-Based Intrusion Detection

Pierre-François Marteau 1
1 EXPRESSION - Expressiveness in Human Centered Data/Media
UBS - Université de Bretagne Sud, IRISA-D6 - MEDIA ET INTERACTIONS
Abstract : This paper introduces a new similarity measure, the covering similarity, that we formally define for evaluating the similarity between a symbolic sequence and a set of symbolic sequences. A pair-wise similarity can also be directly derived from the covering similarity to compare two symbolic sequences. An efficient implementation to compute the covering similarity is proposed that uses a suffix tree data-structure, but other implementations, based on suffix array for instance, are possible and possibly necessary for handling large scale problems. We have used this similarity to isolate attack sequences from normal sequences in the scope of Host-based Intrusion Detection. We have assessed the covering similarity on two well-known benchmarks in the field. In view of the results reported on these two datasets for the state of the art methods, and according to the comparative study we have carried out based on three challenging similarity measures commonly used for string processing or in bioinformatics, we show that the covering similarity is particularly relevant to address the detection of anomalies in sequences of system calls
Type de document :
Article dans une revue
IEEE Transactions on Information Forensics and Security, Institute of Electrical and Electronics Engineers, inPress, pp.1--14. 〈https://ieeexplore.ieee.org/document/8454473/〉. 〈10.1109/TIFS.2018.2868614〉
Liste complète des métadonnées

https://hal.archives-ouvertes.fr/hal-01653650
Contributeur : Pierre-François Marteau <>
Soumis le : vendredi 24 août 2018 - 11:46:53
Dernière modification le : jeudi 6 septembre 2018 - 08:21:12

Fichiers

suffixLearning4AnomalyDetectio...
Fichiers produits par l'(les) auteur(s)

Identifiants

Citation

Pierre-François Marteau. Sequence Covering for Efficient Host-Based Intrusion Detection. IEEE Transactions on Information Forensics and Security, Institute of Electrical and Electronics Engineers, inPress, pp.1--14. 〈https://ieeexplore.ieee.org/document/8454473/〉. 〈10.1109/TIFS.2018.2868614〉. 〈hal-01653650v2〉

Partager

Métriques

Consultations de la notice

152

Téléchargements de fichiers

33