Recent Advances in Intrusion Detection

Volume 2820 of the series Lecture Notes in Computer Science pp 207-219

Two Sophisticated Techniques to Improve HMM-Based Intrusion Detection Systems

  • Sung-Bae ChoAffiliated withDept. of Computer Science, Yonsei University
  • , Sang-Jun HanAffiliated withDept. of Computer Science, Yonsei University

* Final gross prices may vary according to local VAT.

Get Access


Hidden Markov model (HMM) has been successfully applied to anomlay detection as a technique to model normal behavior. Despite its good performance, there are some problems in applying it to real intrusion detection systems: it requires large amount of time to model normal behaviors and the false-positive error rate is relatively high. To remedy these problems, we have proposed two techniques: extracting privilege flows to reduce the normal behaviors and combining multiple models to reduce the false-positive error rate. Experimental results with real audit data show that the proposed method requires significantly shorter time to train HMM without loss of detection rate and significantly reduces the false-positive error rate.


anomaly detection hidden Markov model privilege flow combining multiple models