Cover Image

A study on advanced statistical analysis for network anomaly detection

Algorithms for building detection models are usually classified into two categories: misuse detection and anomaly detection. Misuse detection algorithms model know attack behavior. They compare sensor data to attack patterns learned from the training data. Anomaly detection algorithms model normal b...

Full description

Saved in:
Bibliographic Details
Main Authors: Ngadi, Md. Asri, Idris, Mohd. Yazid, Abdullah, Abd. Hanan
Format: Monograph
Published: Faculty of Computer Science and Information System 2005
Online Access:http://eprints.utm.my/id/eprint/9074/
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.utm.9074
record_format eprints
spelling my.utm.90742017-08-14T06:53:26Z http://eprints.utm.my/id/eprint/9074/ A study on advanced statistical analysis for network anomaly detection Ngadi, Md. Asri Idris, Mohd. Yazid Abdullah, Abd. Hanan Algorithms for building detection models are usually classified into two categories: misuse detection and anomaly detection. Misuse detection algorithms model know attack behavior. They compare sensor data to attack patterns learned from the training data. Anomaly detection algorithms model normal behavior. Anomaly detection models compare sensor data to normal patterns learned from the training data by using statistical method and try to detect activity that deviates from normal activity. Although Anomaly IDS might be complete, its accuracy is questionable since this approach suffers from a high false positive alarm rate and misclassification.This project expects an enhancement algorithm to be able to reduce a false positive alarm and misclassification rate. This research investigated a discriminant analysis method for detecting intrusions based on number of system calls during an activity on host machine. This method attempts to separate intrusions from normal activities. This research detects intrusions by analyzing at least system call occurring on activities, and can also tell whether an activity is an intrusion. The focus of this analysis is on original observations that performed a detecting outlier and power transformation to transform not normally distributed data to near normality. The correlation of each system calls are examined using coefficient correlations of each selected system call variables. This approach is a lightweight intrusion detection method, given that requires only nine system calls that are strongly correlated to intrusions for analysis. Moreover, this approach does not require user profiles or a user activity database in order to detect intrusions. Lastly, this method can reduce a high false positive alarm rate and misclassification for detecting process. Faculty of Computer Science and Information System 2005-08-31 Monograph NonPeerReviewed Ngadi, Md. Asri and Idris, Mohd. Yazid and Abdullah, Abd. Hanan (2005) A study on advanced statistical analysis for network anomaly detection. Project Report. Faculty of Computer Science and Information System, Skudai, Johor. (Unpublished)
institution Universiti Teknologi Malaysia
building UTM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Teknologi Malaysia
content_source UTM Institutional Repository
url_provider http://eprints.utm.my/
description Algorithms for building detection models are usually classified into two categories: misuse detection and anomaly detection. Misuse detection algorithms model know attack behavior. They compare sensor data to attack patterns learned from the training data. Anomaly detection algorithms model normal behavior. Anomaly detection models compare sensor data to normal patterns learned from the training data by using statistical method and try to detect activity that deviates from normal activity. Although Anomaly IDS might be complete, its accuracy is questionable since this approach suffers from a high false positive alarm rate and misclassification.This project expects an enhancement algorithm to be able to reduce a false positive alarm and misclassification rate. This research investigated a discriminant analysis method for detecting intrusions based on number of system calls during an activity on host machine. This method attempts to separate intrusions from normal activities. This research detects intrusions by analyzing at least system call occurring on activities, and can also tell whether an activity is an intrusion. The focus of this analysis is on original observations that performed a detecting outlier and power transformation to transform not normally distributed data to near normality. The correlation of each system calls are examined using coefficient correlations of each selected system call variables. This approach is a lightweight intrusion detection method, given that requires only nine system calls that are strongly correlated to intrusions for analysis. Moreover, this approach does not require user profiles or a user activity database in order to detect intrusions. Lastly, this method can reduce a high false positive alarm rate and misclassification for detecting process.
format Monograph
author Ngadi, Md. Asri
Idris, Mohd. Yazid
Abdullah, Abd. Hanan
spellingShingle Ngadi, Md. Asri
Idris, Mohd. Yazid
Abdullah, Abd. Hanan
A study on advanced statistical analysis for network anomaly detection
author_facet Ngadi, Md. Asri
Idris, Mohd. Yazid
Abdullah, Abd. Hanan
author_sort Ngadi, Md. Asri
title A study on advanced statistical analysis for network anomaly detection
title_short A study on advanced statistical analysis for network anomaly detection
title_full A study on advanced statistical analysis for network anomaly detection
title_fullStr A study on advanced statistical analysis for network anomaly detection
title_full_unstemmed A study on advanced statistical analysis for network anomaly detection
title_sort study on advanced statistical analysis for network anomaly detection
publisher Faculty of Computer Science and Information System
publishDate 2005
url http://eprints.utm.my/id/eprint/9074/
_version_ 1643645111478779904
score 13.222552

Similar Items