Abstract
This research explores four experiments of adaptive host-based intrusion detection (ID) techniques in an attempt to develop systems that can detect novel exploits. The technique considered to have the most potential is adaptive critic designs (ACDs) because of their utilization of reinforcement learning, which allows learning exploits that are difficult to pinpoint in sensor data. Preliminary results of ID using an ACD, an Elman recurrent neural network, and a statistical anomaly detection technique demonstrate an ability to learn to distinguish between clean and exploit data. We used the Solaris Basic Security Module (BSM) as a data source and performed considerable preprocessing on the raw data. A detection approach called generalized signature-based ID is recommended as a middle ground between signature-based ID, which has an inability to detect novel exploits, and anomaly detection, which detects too many events including events that are not exploits. The primary results of the ID experiments demonstrate the use of custom data for generalized signature-based intrusion detection and the ability of neural network-based systems to learn in this application environment.
Recommended Citation
T. Draelos et al., "Experiments on Adaptive Techniques for Host-Based Intrusion Detection,", pp. 1 - 66 United States. Department of Energy, Jan 2001.
Department(s)
Electrical and Computer Engineering
Report Number
SAND2001-3065
Document Type
Technical Report
Document Version
Final Version
File Type
text
Language(s)
English
Rights
© 2001 United States. Department of Energy, All rights reserved.
Publication Date
01 Jan 2001
