Suppressing false alarms of intrusion detection using improved text categorization method

Zonghua Zhang; Hong Shen

doi:10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method

Zonghua Zhang, Hong Shen

Grad. Sch./Info. Sci. and Technology

研究成果: Conference contribution › 同行評審

4 引文斯高帕斯（Scopus）

摘要

Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

原文	English
主出版物標題	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004
發行者	IEEE Computer Society
頁面	163-166
頁數	4
ISBN（列印）	0769520731, 9780769520735
DOIs	https://doi.org/10.1109/eee.2004.1287303
出版狀態	Published - 2004
對外發佈	是
事件	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 - Taipei, Taiwan, Province of China 持續時間: 28 3月 2004 → 31 3月 2004

出版系列

名字	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

Conference

Conference	Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004
國家/地區	Taiwan, Province of China
城市	Taipei
期間	28/03/04 → 31/03/04

存取文件

10.1109/eee.2004.1287303

其它文件與鏈接

Link to publication in Scopus

引用此

Zhang, Z., & Shen, H. (2004). Suppressing false alarms of intrusion detection using improved text categorization method. 於 Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 (頁 163-166). (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004). IEEE Computer Society. https://doi.org/10.1109/eee.2004.1287303

@inproceedings{63edba20ea7d42c2b787c8624e2ed748,

title = "Suppressing false alarms of intrusion detection using improved text categorization method",

abstract = "Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.",

author = "Zonghua Zhang and Hong Shen",

year = "2004",

doi = "10.1109/eee.2004.1287303",

language = "English",

isbn = "0769520731",

series = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004",

publisher = "IEEE Computer Society",

pages = "163--166",

booktitle = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004",

address = "United States",

note = "Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004 ; Conference date: 28-03-2004 Through 31-03-2004",

}

Zhang, Z & Shen, H 2004, Suppressing false alarms of intrusion detection using improved text categorization method. 於 Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004, IEEE Computer Society, 頁 163-166, Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004, Taipei, Taiwan, Province of China, 28/03/04. https://doi.org/10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method. / Zhang, Zonghua; Shen, Hong.
Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. IEEE Computer Society, 2004. p. 163-166 (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004).

研究成果: Conference contribution › 同行評審

TY - GEN

T1 - Suppressing false alarms of intrusion detection using improved text categorization method

AU - Zhang, Zonghua

AU - Shen, Hong

PY - 2004

Y1 - 2004

N2 - Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

AB - Although some text processing techniques can be em-ployed to intrusion detection based on the characterization of the frequencies of the system calls executed by the priv-ileged programs, and achieve satisfactory detection accu-racy, high false alarms make it hardly practicable in real life. In this paper, we modified the traditional weighting method tf-idf for suppressing false alarms by considering the necessary information between the processes and sessions. Preliminary experiments with 1998 DRRPA BSM auduit data show that our modified method can suppress high false alarms effectively while maintaining satisfactory detection accuracy, which thus make text categorization ap-proaches more practicable for intrusion detection.

UR - http://www.scopus.com/inward/record.url?scp=4544293260&partnerID=8YFLogxK

U2 - 10.1109/eee.2004.1287303

DO - 10.1109/eee.2004.1287303

M3 - Conference contribution

AN - SCOPUS:4544293260

SN - 0769520731

SN - 9780769520735

T3 - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

SP - 163

EP - 166

BT - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

PB - IEEE Computer Society

T2 - Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004

Y2 - 28 March 2004 through 31 March 2004

ER -

Zhang Z, Shen H. Suppressing false alarms of intrusion detection using improved text categorization method. 於 Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004. IEEE Computer Society. 2004. p. 163-166. (Proceedings - 2004 IEEE International Conference on e-Technology, e-Commerce and e-Service, EEE 2004). doi: 10.1109/eee.2004.1287303

Suppressing false alarms of intrusion detection using improved text categorization method

摘要

出版系列

Conference

存取文件

其它文件與鏈接

指紋

引用此