A probabilistic method for detecting anomalous program behavior

Kohei Tatara, Toshihiro Yamauchi, Kouichi Sakurai

Research output: Contribution to journalConference article

Abstract

In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

Original languageEnglish
Pages (from-to)87-98
Number of pages12
JournalLecture Notes in Computer Science
Volume3325
Publication statusPublished - Sep 1 2005
Externally publishedYes
Event5th International Workshop on Information Security Applications, WISA 2004 - Jeju Island, Korea, Republic of
Duration: Aug 23 2004Aug 25 2004

Fingerprint

Probabilistic Methods
Bayesian networks
Anomalous
Bayesian Networks
Prediction Model

Keywords

  • Anomaly detection
  • Bayesian network
  • Intrusion detection
  • System call

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

A probabilistic method for detecting anomalous program behavior. / Tatara, Kohei; Yamauchi, Toshihiro; Sakurai, Kouichi.

In: Lecture Notes in Computer Science, Vol. 3325, 01.09.2005, p. 87-98.

Research output: Contribution to journalConference article

@article{b7d7f29debe947f9934f775dd523c35e,
title = "A probabilistic method for detecting anomalous program behavior",
abstract = "In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.",
keywords = "Anomaly detection, Bayesian network, Intrusion detection, System call",
author = "Kohei Tatara and Toshihiro Yamauchi and Kouichi Sakurai",
year = "2005",
month = "9",
day = "1",
language = "English",
volume = "3325",
pages = "87--98",
journal = "Lecture Notes in Computer Science",
issn = "0302-9743",
publisher = "Springer Verlag",

}

TY - JOUR

T1 - A probabilistic method for detecting anomalous program behavior

AU - Tatara, Kohei

AU - Yamauchi, Toshihiro

AU - Sakurai, Kouichi

PY - 2005/9/1

Y1 - 2005/9/1

N2 - In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

AB - In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

KW - Anomaly detection

KW - Bayesian network

KW - Intrusion detection

KW - System call

UR - http://www.scopus.com/inward/record.url?scp=23944486376&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=23944486376&partnerID=8YFLogxK

M3 - Conference article

AN - SCOPUS:23944486376

VL - 3325

SP - 87

EP - 98

JO - Lecture Notes in Computer Science

JF - Lecture Notes in Computer Science

SN - 0302-9743

ER -