Using Text Categorization Techniques for Intrusion Detection

TLDR

Short system‑call sequences have been used to model program behavior, but building separate databases for each program requires time‑consuming training and testing. The study proposes a k‑Nearest Neighbor classifier to classify program behavior as normal or intrusive. The method represents each process as a vector of system‑call frequencies and uses k‑NN similarity to detect intrusions. The approach eliminates the need for individual program profiles, reducing computation, and preliminary experiments on 1998 DARPA BSM audit data show effective intrusion detection with a low false‑positive rate.

Abstract

A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive. Short sequences of system calls have been used by others to characterize a program’s normal behavior before. However, separate databases of short system call sequences have to be built for different programs, and learning program profiles involves time-consuming training and testing processes. With the kNN classifier, the frequencies of system calls are used to describe the program behavior. Text categorization techniques are adopted to convert each process to a vector and calculate the similarity between two program activities. Since there is no need to learn individual program profiles separately, the calculation involved is largely reduced. Preliminary experiments with 1998 DARPA BSM audit data show that the kNN classifier can effectively detect intrusive attacks and achieve a low false positive rate.