NDLI: Profiling program and user behaviors for anomaly intrusion detection based on non-negative matrix factorization

Content Provider	IEEE Xplore Digital Library
Author	Wei Wang Xiaohong Guan Xiangliang Zhang
Copyright Year	2004
Description	Author affiliation: State Key Lab. for Manuf. Syst., Xi'an Jiaotong Univ., China (Wei Wang; Xiaohong Guan; Xiangliang Zhang)
Abstract	Profiling program and user behaviors is an effective approach for detecting hostile attacks to a computer system. A new model based method by non-negative matrix factorization (NMF) is presented in this paper to profile program and user behaviors for anomaly intrusion detection. In this new method, the audit data streams obtained from sequences of system calls and UNIX commands are used as the information source. The audit data is partitioned into segments with a fixed length. Program and user behaviors are, in turn, measured by the frequencies of individual system calls or commands embedded in each segment of the data, and NMF is applied to extract the features from the blocks of audit data associated with the normal behaviors. The model describing the normal program and user behaviors are built based on these features and deviation from the normal program and user behaviors above a predetermined threshold is considered as anomalous. The method is implemented and tested with the system call data from the University of New Mexico and the Unix command data from AT&T Research lab. Experiment results show that the proposed method is promising in terms of detection accuracy, computational expense and implementation for real-time intrusion detection.
Starting Page	99
Ending Page	104
File Size	172112
Page Count	6
File Format	PDF
ISBN	0780386825
ISSN	01912216
DOI	10.1109/CDC.2004.1428613
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2004-12-14
Publisher Place	Bahamas
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intrusion detection Computer security Electronic mail Computer networks Monitoring Frequency measurement Data mining Feature extraction System testing Laboratories
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Detecting Insider Attacks Using Non-negative Matrix Factorization

Handling nominal features in anomaly intrusion detection problems

Modeling program behaviors by hidden Markov models for intrusion detection

Information fusion techniques for network intrusion detection

Accommodation recommendation system from user reviews based on feature-based weighted non-negative matrix factorization method

Building intrusion pattern miner for snort network intrusion detection system

Effective Feature Extraction for Intrusion Detection System using Non-negative Matrix Factorization and Univariate analysis

Matrix Factorization Approach for Feature Deduction and Design of Intrusion Detection Systems

Masquerade Detection Using Command Prediction and Association Rules Mining

Profiling program and user behaviors for anomaly intrusion detection based on non-negative matrix factorization

Similar Documents

Detecting Insider Attacks Using Non-negative Matrix Factorization

Handling nominal features in anomaly intrusion detection problems

Modeling program behaviors by hidden Markov models for intrusion detection

Information fusion techniques for network intrusion detection

Accommodation recommendation system from user reviews based on feature-based weighted non-negative matrix factorization method

Building intrusion pattern miner for snort network intrusion detection system

Effective Feature Extraction for Intrusion Detection System using Non-negative Matrix Factorization and Univariate analysis

Matrix Factorization Approach for Feature Deduction and Design of Intrusion Detection Systems

Masquerade Detection Using Command Prediction and Association Rules Mining

Profiling program and user behaviors for anomaly intrusion detection based on non-negative matrix factorization