Suppressing false alarms of intrusion detection using improved text categorization method

Zonghua Zhang; Hong Shen

doi:10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method

Zonghua Zhang, Hong Shen

Grad. Sch./Info. Sci. and Technology

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

4 Citations (Scopus)

Abstract

Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

Original language	English
Title of host publication	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004
Publisher	IEEE Computer Society
Pages	163-166
Number of pages	4
ISBN (Print)	0769520731, 9780769520735
DOIs	https://doi.org/10.1109/eee.2004.1287303
Publication status	Published - 2004
Externally published	Yes
Event	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 - Taipei, Taiwan, Province of China Duration: 28 Mar 2004 → 31 Mar 2004

Publication series

Name	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

Conference

Conference	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004
Country/Territory	Taiwan, Province of China
City	Taipei
Period	28/03/04 → 31/03/04

Access to Document

10.1109/eee.2004.1287303

Cite this

Zhang, Z., & Shen, H. (2004). Suppressing false alarms of intrusion detection using improved text categorization method. In Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 (pp. 163-166). (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004). IEEE Computer Society. https://doi.org/10.1109/eee.2004.1287303

@inproceedings{63edba20ea7d42c2b787c8624e2ed748,

title = "Suppressing false alarms of intrusion detection using improved text categorization method",

abstract = "Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.",

author = "Zonghua Zhang and Hong Shen",

year = "2004",

doi = "10.1109/eee.2004.1287303",

language = "English",

isbn = "0769520731",

series = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004",

publisher = "IEEE Computer Society",

pages = "163--166",

booktitle = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004",

address = "United States",

note = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 ; Conference date: 28-03-2004 Through 31-03-2004",

}

Zhang, Z & Shen, H 2004, Suppressing false alarms of intrusion detection using improved text categorization method. in Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004, IEEE Computer Society, pp. 163-166, Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004, Taipei, Taiwan, Province of China, 28/03/04. https://doi.org/10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method. / Zhang, Zonghua; Shen, Hong.
Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. IEEE Computer Society, 2004. p. 163-166 (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Suppressing false alarms of intrusion detection using improved text categorization method

AU - Zhang, Zonghua

AU - Shen, Hong

PY - 2004

Y1 - 2004

N2 - Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

AB - Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

UR - http://www.scopus.com/inward/record.url?scp=4544293260&partnerID=8YFLogxK

U2 - 10.1109/eee.2004.1287303

DO - 10.1109/eee.2004.1287303

M3 - Conference contribution

AN - SCOPUS:4544293260

SN - 0769520731

SN - 9780769520735

T3 - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

SP - 163

EP - 166

BT - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

PB - IEEE Computer Society

T2 - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

Y2 - 28 March 2004 through 31 March 2004

ER -

Zhang Z, Shen H. Suppressing false alarms of intrusion detection using improved text categorization method. In Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. IEEE Computer Society. 2004. p. 163-166. (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004). doi: 10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this