The Study of Intrusion Prediction Based on HsMM

Abstract

Intrusion detection is an important technique in the defense-in-depth network security framework. The IDS continuously watch the activity on a network or computer, looking for attack and intrusion evidences. However, host-based intrusion detectors are particularly vulnerable, as they can be disabled or tampered by successful intruders. In this paper, a hidden semi-Markov models method for predicting the anomaly events and the intentions of possible intruders to a computer system is developed based on the observation of system call sequences. BSM audit data are used as research data sources. The HsMM structure is redefined to describe the intrusion detection. The time duration of the hidden states is computed by contributing the risk factor of every system call. Then the output probability of current system call sequences are calculated to decide whether the current system behavior is normal and compute the anomaly probability of the subsequent system calls. In the addition, the approximate time when the intrusion has established is estimated. The evaluation of the proposed methodology was carried out through DARPA 1998.The experiment result proves that the proposed method can find the attack attempt in advance to gain the precious time of the active intrusion precaution.