Abstract
Short sequences of system calls have been proven to be a good signature description for anomalous intrusion detection. The signature provides clear separation between different kinds of programs. This paper extends these works by applying fuzzy neural network (FNN) to solve the sharp boundary problem and decide whether a sequence is “normal” or “abnormal”. By using threat level of system calls to label the sequences the proposed FNN improves the accuracy of anomaly detection.
This research was supported by the National High Technology Development 863 program of China under Grant No. 2002AA142010 and Tianjin Key Science Item.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Ghosh, A.K., Schwartzbart, A., Schatz, M.: Learning Program Behavior Profiles for Intrusion Detection. In: Proceedings 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California (1999)
Liu, Z., Florez, G., Bridges, S.M.: A Comparison of Input Representations In Neural Networks: A Case Study in Intrusion detection. In: International Joint Conference on Neural Networks (IJCNN), Honolulu, Hawaii (2002)
Yuan, F., Wu, H., Yu, G.: Web Users’ Classification Using Fuzzy Neural Network. In: Knowledge-Based Intelligent Information and Engineering Systems: 8th International Conference, Kes 2004, Wellington, New Zealand (September 2004)
Warrender, C., Forrest, S., Pearlmutter, B.: Detecting Intrusions Using System Calls: alternative data models. IEEE Computer Society, Los Alamitos (1999)
Hofmeyr, S.A., Forrest, S., Somayaji, A.: Intrusion detection using sequences of system calls. Journal of Computer Security (1998)
Forrest, S., Hofmeyr, S.A., Somayaji, A., Longstaff, T.A.: A sense of self for unix processes. In: Proceedings of the 1996 IEEE Symposium on Security and Privacy. IEEE Computer Society Press, Los Alamitos (1996)
Lee, W., Stolfo, S., Chan, P.: Learning patterns from Unix process execution traces from intrusion detection. In: AAAI Workshop: AI Approaches to Fraud Detection and risk management (July 1997)
Lee, W., Stolfo, S.: Data Mining Approaches for Intrusion Detection. In: Proc. Of the Seventh USENIX Security Symposium (January 1998)
Florez, G., Bridges, S.M., Vaughn, R.B.: An Improved Algorithm for Fuzzy Data Mining for Intrusion Detection. In: Annual Meeting of The North American Fuzzy Information Processing Society Proceedings (2002)
Liu, Z., Bridges, S.M., Vaughn, R.B.: Classification of anomalous traces of privileged and parallel programs by neural networks. In: Proceedings of The 12th IEEE International Conference on Fuzzy Systems (2003)
Verwoerd, T., Hunt, R.: Intrusion detection techniques and approaches. Computer Communications 25(15) (September 15, 2002)
Michael, C.C.: Finding the Vocabulary of Program Behavior Data for Anomaly Detection. In: Proceedings DARPA Information Survivability Conference and Exposition, vol. 1 (2003)
Xu, M., Chen, C., Ying, J.: Anomaly Detection Based on System Call Classification. Journal of Software 15 (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Zhang, G., Sun, J. (2005). Applying Fuzzy Neural Network to Intrusion Detection Based on Sequences of System Calls. In: Li, X., Wang, S., Dong, Z.Y. (eds) Advanced Data Mining and Applications. ADMA 2005. Lecture Notes in Computer Science(), vol 3584. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11527503_58
Download citation
DOI: https://doi.org/10.1007/11527503_58
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-27894-8
Online ISBN: 978-3-540-31877-4
eBook Packages: Computer ScienceComputer Science (R0)