Utilizing statistical characteristics of N-grams for intrusion detection

Abstract

Information and infrastructure security is a serious issue of global concern. As the last line of defense for security infrastructure, intrusion detection techniques are paid more and more attention. In this paper, one anomaly-based intrusion detection technique (ScanAID: Statistical ChAracteristics of N-grams for Anomaly-based Intrusion Detection) is proposed to detect intrusive behaviors in a computer system. The statistical properties in sequences of system calls are abstracted to model the normal behaviors of a privileged process, in which the model is characterized by a vector of anomaly values of N-grams. With a reasonable definition of efficiency parameter, the length of an N-gram and the size of the training dataset are optimized to get an efficient and compact model. Then, with the optimal modeling parameters, the flexibility and efficiency of the model are evaluated by the ROC curves. Our experimental results show that the proposed statistical anomaly detection technique is promising and deserves further research (such as applying it to network environments).