GPU를 통해 가속화 된 은닉 마르코프 모델 기반 비정상 침입탐지시스템
Hidden Markov Model (HMM) based Anomaly Intrusion Detection System (IDS) Boosted by GPU
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
For the Network Operations (NetOps) in cyberspace considered as the 4th warfare, detecting intrusion on network systems is important to prevent systems from further hostility of enemy. In this paper, we propose a host-based Intrusion Detection System (IDS) by using Hidden Markov Model (HMM) which is used for wide area of pattern recognition, e.g. voice recognition and computer vision. The model is trained using public system call dataset generated by computer programs to model normal behavior of network user. Especially, we overcome excessive training time of HMM which is considered as general shortage of the model by parallelized training and test processes using Graphics Processing Unit (GPU). Experimental results show that the proposed IDS detects normal and intrusion process with 86% accuracy in average, and training and test time can be boosted proportional to the size of dataset and the sliding window.
Abstract
For the Network Operations (NetOps) in cyberspace considered as the 4th warfare, detecting intrusion on network systems is important to prevent systems from further hostility of enemy. In this paper, we propose a host-based Intrusion Detection System (IDS) by using Hidden Markov Model (HMM) which is used for wide area of pattern recognition, e.g. voice recognition and computer vision. The model is trained using public system call dataset generated by computer programs to model normal behavior of network user. Especially, we overcome excessive training time of HMM which is considered as general shortage of the model by parallelized training and test processes using Graphics Processing Unit (GPU). Experimental results show that the proposed IDS detects normal and intrusion process with 86% accuracy in average, and training and test time can be boosted proportional to the size of dataset and the sliding window.
참고문헌 (12)
- An introduction to intrusion detection & assessment, "Bace, R", ICSA IN C, ~ (2001)
- Bace, R., "Intrusion detection" (2000), Sams Publishing
- A gentle tutorial on the em algorithm and its application to parameter estimation for gaussian mixture and hidden markov models, "Bilmes, A. J.", ~ (1997)
- Caswell, B., "Snort 2.0 intrusion detection" (2003), Syngress
- Denning, D. E, "An intrusion-detection model", IEEE Trans. Software Eng, pp.222~232 (1982)
- Dua, S, "Data mining and machine learning in cybersecurity", pp.11~12 (2011), CRC Press
- Elliott, R. J., "Hidden markov models: Estimation and control" (1995), Springer
- Morris, D., "Probability and statistics" (2011), Pearson Education
- Northcutt, S., "Network intrusion detection" (2002), Sams Publishing
- Wang, W., "Profiling program behavior for anomaly intrusion detection based on transition and frequency property of computer audit data", Computers & Security, pp.539~550 (2006)
- Warrender, C., "Detecting intrusions using system calls: alternative data models", Proc. of the IEEE Symposium on Security and Privacy, pp.133~145 (1999)
- Yeung, D. Y, "Host-based intrusion detection using dynamic and static behavioral models", Pattern Recognition, pp.229~243 (2001)