Skip to main content
Article
Experiments on Adaptive Techniques for Host-Based Intrusion Detection
Electrical and Computer Engineering Faculty Research & Creative Works
  • Timothy Draelos
  • Michael Collins
  • David Duggan
  • Edward Thomas
  • Donald C. Wunsch, Missouri University of Science and Technology
Abstract

This research explores four experiments of adaptive host-based intrusion detection (ID) techniques in an attempt to develop systems that can detect novel exploits. The technique considered to have the most potential is adaptive critic designs (ACDs) because of their utilization of reinforcement learning, which allows learning exploits that are difficult to pinpoint in sensor data. Preliminary results of ID using an ACD, an Elman recurrent neural network, and a statistical anomaly detection technique demonstrate an ability to learn to distinguish between clean and exploit data. We used the Solaris Basic Security Module (BSM) as a data source and performed considerable preprocessing on the raw data. A detection approach called generalized signature-based ID is recommended as a middle ground between signature-based ID, which has an inability to detect novel exploits, and anomaly detection, which detects too many events including events that are not exploits. The primary results of the ID experiments demonstrate the use of custom data for generalized signature-based intrusion detection and the ability of neural network-based systems to learn in this application environment.

Department(s)
Electrical and Computer Engineering
Report Number
SAND2001-3065
Document Type
Technical Report
Document Version
Final Version
File Type
text
Language(s)
English
Rights
© 2001 United States. Department of Energy, All rights reserved.
Publication Date
1-1-2001
Publication Date
01 Jan 2001
Citation Information
Timothy Draelos, Michael Collins, David Duggan, Edward Thomas, et al.. "Experiments on Adaptive Techniques for Host-Based Intrusion Detection" (2001) p. 1 - 66
Available at: http://works.bepress.com/donald-wunsch/214/