Home

Modeling System Calls for Intrusion Detection with Dynamic Window Sizes

Eleazar Eskin; Wenke Lee; Salvatore Stolfo

Title:
Modeling System Calls for Intrusion Detection with Dynamic Window Sizes
Author(s):
Eskin, Eleazar
Lee, Wenke
Stolfo, Salvatore
Date:
Type:
Articles
Department:
Computer Science
Permanent URL:
Notes:
DISCEX'01: DARPA Information Survivability Conference & Exposition II: proceedings: 12-14 June, 2001, Anaheim, California, vol. 1 (Los Alamitos, Calif.: IEEE Computer Society, 2001), pp. 165-175.
Abstract:
We extend prior research on system call anomaly detection modeling methods for intrusion detection by incorporating dynamic window sizes. The window size is the length of the subsequence of a system call trace which is used as the basic unit for modeling program or process behavior. In this work we incorporate dynamic window sizes and show marked improvements in anomaly detection. We present two methods for estimating the optimal window size based on the available training data. The first method is an entropy modeling method which determines the optimal single window size for the data. The second method is a probability modeling method that takes into account context dependent window sizes. A context dependent window size model is motivated by the way that system calls are generated by processes. Sparse Markov transducers (SMTs) are used to compute the context dependent window size model. We show over actual system call traces that the entropy modeling methods lead to the optimal single window size. We also show that context dependent window sizes outperform traditional system call modeling methods.
Subject(s):
Computer science
Publisher DOI:
http://dx.doi.org/10.1109/DISCEX.2001.932213
Item views:
263
Metadata:
text | xml

In Partnership with the Center for Digital Research and Scholarship at Columbia University Libraries/Information Services | Terms of Use