• Journal of the Korea Society of Computer and Information
• /
• v.8 no.1
• /
• pp.103-113
• /
• 2003

Program Behavior Intrusion Detection Technique analyses system calls that called by daemon program or root authority, constructs profiles. and detectes anomaly intrusions effectively. Anomaly detections using system calls are detected only anomaly processes. But this has a Problem that doesn't detect affected various Part by anomaly processes. To improve this problem, the relation among system calls of processes is represented by bayesian probability values. Application behavior profiling by Bayesian Network supports anomaly intrusion informations . This paper overcomes the Problems of various intrusion detection models we Propose effective intrusion detection technique using Bayesian Networks. we have profiled concisely normal behaviors using behavior context. And this method be able to detect new intrusions or modificated intrusions we had simulation by proposed normal behavior profiling technique using UNM data.

• The KIPS Transactions:PartC
• /
• v.10C no.2
• /
• pp.119-124
• /
• 2003

Although there have been many studies on using finite automata for intrusion detection, it has been a difficult problem to generate compact finite automata automatically. In a previous research an approach to profile normal behaviors using finite automata was proposed. They divided the system call sequence of each process into three parts prefix, main portion, and suffix, and then substituted macros for frequently occurring substrings. However, the procedure was not automatic. In this paper we present algorithms to automatically generate intrusion detection automata from the sequence of system calls resulting from the normal runs of the programs. We also show the effectiveness of the proposed method through experiments.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2001.10b
• /
• pp.923-926
• /
• 2001

침입 탐지 기법에 있어서 finite automata 를 통해 정상 행위를 프로파일링 하는 연구들이 많이 진행되어 왔으나, 자동으로 간결한 형태의 오토마타를 생성하는 것이 매우 어려웠다. 이 논문에서는 많은 침입 탐지 기법의 데이터 소스로 사용되고 있는 시스템 콜을 이용하여 자동으로 finite automata 를 생성하고, 여기에 언어 압축 알고리즘을 이용하여 오토마타를 압축하고 일반화 시킴으로써 다양한 프로세스의 행위들을 프로파일링 하도록 하였다. 제안된 알고리즘을 통해 모델링한 후 정상 행위와 비정상 행위를 가지고 실험을 한 결과 이들 사이에는 많은 수치적인 차이가 있음을 발견하였고, 이 결과를 바탕으로 침입을 탐지하는 것도 충분히 가능함을 알 수 있었다.