A Brief Observation-Centric Analysis on Anomaly-Based Intrusion Detection

  • Zonghua Zhang
  • Hong Shen
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3439)


This paper is focused on the analysis of the anomaly-based intrusion detectors’ operational capabilities and drawbacks, from the perspective of their operating environments, instead of the schemes per se. Based on the similarity with the induction problem, anomaly detection is cast in a statistical framework for describing their general anticipated behaviors. Several key problems and corresponding potential solutions about the normality characterization for the observable subjects from hosts and networks are addressed respectively, together with the case studies of several representative detection models. Anomaly detectors’ evaluation are also discussed briefly based on some existing achievements. Careful analysis shows that the fundamental understanding of the operating environments is the essential stage in the process of establishing an effective anomaly detection model, which therefore worth insightful exploration, especially when we face the dilemma between the detection performance and the computational cost.


Operating Environment False Alarm Rate Intrusion Detection Anomaly Detection System Call 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Burgess, M., Haugerud, H., Straumsnes, S.: Measuring System Normality. ACM Transactions on Computer Systems 20(2), 125–160 (2002)CrossRefGoogle Scholar
  2. 2.
    Cormode, G., Datar, M., Lndyk, P., Muthukrishnan, S.: Comparing Data Streams Using Hamming Norms(How to Zero). IEEE Transaction on Knowledge and Data Engineering 15(3), 529–540 (2003)CrossRefGoogle Scholar
  3. 3.
    Forrest, S., Hofmeyr, S.A., Longstaff, T.A.: A sense of self for UNIX processes. In: proceedings of 1996 IEEE Symposium on Security and Privacy. IEEE Computer Society Press, Los Alamitos (1996)Google Scholar
  4. 4.
    Guha, S., Meyerson, A., Mishra, N., Motwani, R., O’Callaghan, L.: Clustering Data Streams: Theory and Practice. IEEE Transaction on Knowledge and Data Engineering 15(3), 515–528 (2003)CrossRefGoogle Scholar
  5. 5.
    Helman, P., Liepins, G.: Statistical Foundataions of Audit Trail Analysis for the Detection of Computer Misuse. IEEE Transaction on Software Engineering 19(9) (September 1993)Google Scholar
  6. 6.
    Hofmeyr, S.A., Forrest, S., Somayaji, A.: Intrusion Detection using Sequences of System Calls. Journal of Computer Security, 151–180 (1998)Google Scholar
  7. 7.
    Steiner, S.H.: Grouped Data Exponentially Weighted Moving Average Control Charts, Technical Report, Universtiy of Waterloo (1997)Google Scholar
  8. 8.
    Hutter, M.: Optimality of universal Bayesian sequence prediction for general loss and alphabet. Journal of Machine Learning Research 4, 971–1000 (2003)CrossRefMathSciNetGoogle Scholar
  9. 9.
    Lee, W., Xiang, D.: Information-theoretic meaasures for anomaly detection. In: IEEE Symposium on Security and Privacy, Oakland, California, May 14-16, pp. 130–143. IEEE Computer Society Press, Los Alamitos (2001)Google Scholar
  10. 10.
    Ma, S., Ji, C.: Modeling Heterogeneous Network Traffic in Wavelet Domain. IEEE/ACM Transactions On Networking 9(5), 634–649 (2001)CrossRefGoogle Scholar
  11. 11.
    Maxion, R.A., Tan, K.M.C.: Anomaly Detection in Embedded Systems. IEEE Transaction on Computers 51(2) (February 2002)Google Scholar
  12. 12.
    Mchugh, J.: Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Laboratory. ACM Transactions on Information and System Security 3(4), 262–294 (2000)CrossRefGoogle Scholar
  13. 13.
    Solomonoff, R.J.: Three Kinds of Probabilistic Induction: Universal Distributions and Convergence Theorems. Machine LearningGoogle Scholar
  14. 14.
    Tan, K.M.C., Maxion, R.A.: “Why 6” Defining the Operational Limites of stide, an Anomaly-Based Intrusion Detector. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, S&P 2002 (2002)Google Scholar
  15. 15.
    Warrender, C., Forrest, S., Pearlumtter, B.: Detecting Intrusions Using System Calls: Alternative Data Models. In: 1999 IEEE Symposium on Security and Privacy (May 1999)Google Scholar
  16. 16.
    Ye, N., Li, X., Chen, Q., Emran, S.M., Xu, M.: Probabilistic Techniques for Intrusion Detection Based on Computer Audit Data. IEEE Transaction on Systems, Man, and Cybernetics-Part A:Systems and Humans 31(4) (July 2001)Google Scholar
  17. 17.
    Yeung, D.-Y., Ding, Y.: Host-based intrusion detection using dynamic and static behavioral models. Pattern Recognition 36, 229–243 (2003)zbMATHCrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Zonghua Zhang
    • 1
  • Hong Shen
    • 1
  1. 1.Graduate School of Information ScienceJapan Advanced Institute of Science and TechnologyIshikwaJapan

Personalised recommendations