Fast intrusion detection based on a non-negative matrix factorization model

Xiaohong Guan, Wei Wang*, Xiangliang Zhang

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

40 Scopus citations


In this paper, we present an efficient fast anomaly intrusion detection model incorporating a large amount of data from various data sources. A novel method based on non-negative matrix factorization (NMF) is presented to profile program and user behaviors of a computer system. A large amount of high-dimensional data is collected in our experiments and divided into smaller data blocks by a specific scheme. The system call data is divided into blocks by processes, while command data is divided into consecutive blocks with a fixed length. The frequencies of individual elements in each block of data are computed and placed column by column as data vectors to construct a matrix representation. NMF is employed to reduce the high-dimensional data vectors and anomaly detection can be realized as a very simple classifier in low dimensions. Experimental results show that the model presented in this paper is promising in terms of detection accuracy, computation efficiency and implementation for fast intrusion detection.

Original languageEnglish (US)
Pages (from-to)31-44
Number of pages14
JournalJournal of Network and Computer Applications
Issue number1
StatePublished - Jan 2009
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2023-09-21


  • Anomaly detection
  • Computer security
  • Intrusion detection system
  • Non-negative matrix factorization

ASJC Scopus subject areas

  • Hardware and Architecture
  • Computer Networks and Communications
  • Computer Science Applications


Dive into the research topics of 'Fast intrusion detection based on a non-negative matrix factorization model'. Together they form a unique fingerprint.

Cite this