Two State-based Approaches to Program-based Anomaly Detection

This paper describes two recently developed intrusion detection algorithms, and gives experimental results on their performance. The algorithms detect anomalies in execution audit data. One is a simply constructed finite-state machine, and the other monitors statistical deviations from normal program behavior. The performance of these algorithms is evaluated as a function of the amount of available training data, and they are compared to the well-known intrusion detection technique of looking for novel Ò-grams in computer audit data.

• Type: Conference
• Year: 2000
• Where: ACSAC
• Authors: Christoph C. Michael, Anup K. Ghosh
• Keywords: ACSAC 2000, Algorithms Detect Anomalies, Audit Data, Intrusion Detection Algorithms, Security Privacy