Beta 1


Title Intrusion Detection System for Classifying Process Behavior
Author Trung, Nguyen Quang
Supervisor Winther, Ole (Cognitive Systems, Department of Informatics and Mathematical Modeling, Technical University of Denmark, DTU, DK-2800 Kgs. Lyngby, Denmark)
Institution Technical University of Denmark, DTU, DK-2800 Kgs. Lyngby, Denmark
Thesis level Master's thesis
Year 2010
Abstract Nowaday, we use computers for everything from banking and investing to shopping and communicating with others through email or chat programs. Not only for personal use, computers and network of computers become crucial parts of companies, organizations, governments. A lot of important information is stored in computers and transfered across networks and the Internet. Unauthorized users break into systems to have access to private information. This brings the need of a system that can detect and prevent those harmful activities. Intrusion detection systems (IDSs) monitor networks and/or systems to detect malicious activities. That helps us to re-act and stop intruders. There are two types of IDSs, network-based IDSs and host-based IDSs. A network-based IDS monitors network traffic and activities to find attacks, and a host-based IDS monitors activities in a computer system to detect malicious actions. This thesis is a research on using machine learning techniques in implementing a host-based IDS that can tell us a computer process is normal (harmless) or abnormal (harmful). Three machine learning techniques are applied to Basic Security Module (BSM) log files of a Solaris system. Data sets used in experiments are from DARPA Intrusion Detection Evaluation 1998. The research provides some ways to apply Support Vector Machines, k-Nearest Neighbors and Hidden Markov Models to an IDS, and compares performances of these three methods.
Imprint Technical University of Denmark (DTU) : Kgs. Lyngby, Denmark
Series IMM-M.Sc.-2010-58
Fulltext
Original PDF ep10_58.pdf (0.65 MB)
Admin Creation date: 2010-09-10    Update date: 2010-09-10    Source: dtu    ID: 266725    Original MXD