Experimental analysis of hidden Markov model based secure misuse intrusion trace classification and hacking detection

Abstract

In this paper, we consider hidden Markov model (HMM) based sequence classification to misuse based intrusion detection. HMM is one of statistical Markov models that regards the system as a group of observable states and hidden states. We apply HMM for detecting intrusive program traces in some public benchmark datasets including University of New Mexico (UNM) and Massachusetts Institute of Technology: Lincoln Laboratory (MIT LL) datasets. We compare the performance of HMM with that of Naive Bayes (NB) classification algorithm, support vector machines (SVM), and other basic machine learning algorithms. Our experiments and their results on the UNM and MIT LL datasets show that HMM shows comparable performance to previous methods.