The algorithm of information system anomaly detection

Abstract

Principle of anomaly detection technique based on a chi-square statistic was described. Algorithm of Chi-square statistical technique was designed. In order to verify the effect of principle and algorithm, testing data of sample of UNIX and Windows XP system was presented and compared. The results of this study show that chi-square technology achieves the 0% false alarm rate and the 100% detection rate for abnormal intrusion scenarios. All intrusion scenarios are detected at the first or second audit event.