Combining incremental hidden Markov model and Adaboost algorithm for anomaly intrusion detection

Yu Shu Chen, Yi Ming Chen

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

19 Scopus citations

Abstract

Traditional Hidden Markov Model (HMM) has been successfully applied to anomaly intrusion detection. Incremental HMM (IHMM) further improves the training time of HMM. However, both HMM and IHMM still have the problem of high false positive rate. In this paper, we propose an Adaboost-IHMM to combine IHMM and adaboost for anomaly intrusion detection. As adaboost firstly uses many IHMMs to collectively classify samples then decides the results of samples' classifications, the Adaboost-IHMM can improve the accurate rate of classifications. Experimental results with Stide datasets show that the proposed method can significantly improve the false positive rate by 70% without decreasing detection rate. Besides, we also propose a method to adjust the normal profile for avoiding erroneous detection caused by changes of normal behavior. We perform with experiments with realistic datasets extracted from the use of popular browsers. Compared with traditional HMM method, our method can improve the training time by 90% to build a new normal profile.

Original languageEnglish
Title of host publicationProceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics, CSI-KDD in Conjunction with SIGKDD'09
Pages3-9
Number of pages7
DOIs
StatePublished - 2009
EventACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics, CSI-KDD in Conjunction with SIGKDD'09 - Paris, France
Duration: 28 Jun 200928 Jun 2009

Publication series

NameProceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics, CSI-KDD in Conjunction with SIGKDD'09

Conference

ConferenceACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics, CSI-KDD in Conjunction with SIGKDD'09
Country/TerritoryFrance
CityParis
Period28/06/0928/06/09

Keywords

  • Adaboost
  • Anomaly intrusion detection
  • IHMM
  • Normal profile

Fingerprint

Dive into the research topics of 'Combining incremental hidden Markov model and Adaboost algorithm for anomaly intrusion detection'. Together they form a unique fingerprint.

Cite this