IADIS International Journal on Computer Science and Information Systems

Published by IADIS (International Association for Development of the Information Society) • ISSN (Online): 1646-3692 • ISSN (Print): 1646-3692
100% Open Access
Double-Blind Peer Review
Crossref DOI Persistent IDs
Open Access Peer-Reviewed Original Research

Intrusion Detection Using Bayesian Classifier for Arbitrarily Long System Call Sequences

Nasser Assem. Al Akhawayn University *
Ifrane *
Morocco. Researcher *
* n.assem@aui.ma Tajjeeddine Rachidi. Al Akhawayn University, Ifrane 53000, Morocco. t.rachidi@aui.ma Mohamed Taha El Graini. Al Akhawayn University, Ifrane 53000, Morocco. m.elgraini@aui.ma (Portugal)
* n.assem@aui.ma Tajjeeddine Rachidi. Al Akhawayn University, Ifrane 53000, Morocco. t.rachidi@aui.ma Mohamed Taha El Graini. Al Akhawayn University, Ifrane 53000, Morocco. m.elgraini@aui.ma (Portugal)
* n.assem@aui.ma Tajjeeddine Rachidi. Al Akhawayn University, Ifrane 53000, Morocco. t.rachidi@aui.ma Mohamed Taha El Graini. Al Akhawayn University, Ifrane 53000, Morocco. m.elgraini@aui.ma (Portugal)

Abstract

In this paper, we present a sequence classifier for detecting host intrusions from long process system call sequences . The proposed classifier (called SC2.2) is a naïve Bayes classifier that builds class conditional probabilities from Markov modeling of system call sequences. We describe the proposed classifier, and then provide experimental results o n the widely used University of New Mexico ’s system call trace data sets. The r esults of our proposed classifier are benchmarked against leading classifiers, namely naive Bayes multinomial, C4.5 decision tree , RIPPER, support vector machine , and logistic regression. A key feature of the proposed classifier is its ability to handle efficiently arbitrarily long sequences , and zero transitional probabilities in the modeled Markov chain, by using a ―test, backtrack, scale and remultiply‖ technique, and using the m-estimate of conditional probabilities . Furthermore, it capitalizes on IEEE standard for floating-point arithmetic error specification to return classification confidence. Results show that the proposed classifier yields a better performance than standard classifiers on most datasets used.

Keywords

Intrusion detection System call sequence Naive Bayes classifier Markov model M-estimate
Full-Text PDF Available

Read Complete Peer-Reviewed Manuscript

Includes full econometric models, data tables, policy recommendations, declarations, and citations.

Declarations & Ethics

Funding: This research received academic dissemination support through ESCAP / JournalsHub publishing programs.
Conflicts of Interest: The authors declare no competing financial or institutional interests.
Peer Review: Double-blind peer reviewed by international subject specialists.
License: Creative Commons Attribution 4.0 International (CC BY 4.0).
How to Cite This Article
APA / MLA / BibTeX
University, et al. (2014). Intrusion Detection Using Bayesian Classifier for Arbitrarily Long System Call Sequences. IADIS International Journal on Computer Science and Information Systems, 9(1). https://doi.org/10.33965/ijcsis_2014_v9i1_07
University, et al. "Intrusion Detection Using Bayesian Classifier for Arbitrarily Long System Call Sequences." IADIS International Journal on Computer Science and Information Systems, vol. 9, no. 1, 2014. https://doi.org/10.33965/ijcsis_2014_v9i1_07
University, et al. "Intrusion Detection Using Bayesian Classifier for Arbitrarily Long System Call Sequences." IADIS International Journal on Computer Science and Information Systems 9, no. 1 (2014). https://doi.org/10.33965/ijcsis_2014_v9i1_07