Selection, combination, and evaluation of effective software sensors for detecting abnormal computer usage

We present and empirically analyze a machine-learning approach for detecting intrusions on individual computers. Our Winnowbased algorithm continually monitors user and system behavior, recording such properties as the number of bytes transferred over the last 10 seconds, the programs that currently are running, and the load on the CPU. In all, hundreds of measurements are made and analyzed each second. Using this data, our algorithm creates a model that represents each particular computer's range of normal behavior. Parameters that determine when an alarm should be raised, due to abnormal activity, are set on a percomputer basis, based on an analysis of training data. A major issue in intrusion-detection systems is the need for very low falsealarm rates. Our empirical results suggest that it is possible to obtain high intrusion-detection rates (95%) and low false-alarm rates (less than one per day per computer), without "stealing" too many CPU cycles (less than 1%). We...

• Type: Conference
• Year: 2004
• Where: KDD
• Authors: Jude W. Shavlik, Mark Shavlik
• Keywords: Data Mining, KDD 2004, Keywords Intrusion Detection, Low False-alarm Rates, Winnow Algorithm