Exploiting Frequent Episodes in Weighted Suffix Tree to Improve Intrusion Detection System

Abstract

In this paper we proposed a weighted suffix tree and find out it can improve the intrusion detection system (IDS). We firstly focus on the analysis of computer kernel system call, and discover some meaningful information from the unorganized system call sequences. We design a weighted suffix tree algorithm which derives from the concept of suffix tree algorithm for string matching, which then allows to mine the frequent episodes in order to get ordered frequent patterns. We therefore apply these rules to detect malicious attacks, and it shows our IDS still has a good ability to detect intrusion when we use fewer rules.