Sequence Covering for Efficient Host-Based Intrusion Detection

Pierre-François Marteau 1
1 EXPRESSION - Expressiveness in Human Centered Data/Media
UBS - Université de Bretagne Sud, IRISA-D6 - MEDIA ET INTERACTIONS
Abstract : This paper introduces a new similarity measure, the covering similarity, that we formally define for evaluating the similarity between a symbolic sequence and a set of symbolic sequences. A pair-wise similarity can also be directly derived from the covering similarity to compare two symbolic sequences. An efficient implementation to compute the covering similarity is proposed that uses a suffix tree data-structure, but other implementations, based on suffix array for instance, are possible and possibly necessary for handling large scale problems. We have used this similarity to isolate attack sequences from normal sequences in the scope of Host-based Intrusion Detection. The experiment we have carried out on two well-known benchmarks in the field, in view of the results provided by state of the art methods, demonstrates the efficiency and usefulness of the proposed approach.
Type de document :
Pré-publication, Document de travail
Liste complète des métadonnées
Contributeur : Pierre-François Marteau <>
Soumis le : mardi 5 décembre 2017 - 11:46:32
Dernière modification le : mercredi 16 mai 2018 - 11:24:07


Fichiers produits par l'(les) auteur(s)


  • HAL Id : hal-01653650, version 1
  • ARXIV : 1712.02084


Pierre-François Marteau. Sequence Covering for Efficient Host-Based Intrusion Detection. 2017. 〈hal-01653650〉



Consultations de la notice


Téléchargements de fichiers