Fixed vs. Variable-length patterns for detecting suspicious process behavior

Hervé Debar; Marc Dacier; Mehdi Nassehi; Andreas Wespi

doi:10.1007/BFb0055852

Fixed vs. Variable-length patterns for detecting suspicious process behavior

Hervé Debar, Marc Dacier, Mehdi Nassehi, Andreas Wespi

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

19 Scopus citations

Abstract

This paper addresses the problem of creating patterns that can be used to model the normal behavior of a given process. These models can be used for intrusion detection purposes. In a previous work, we presented a novel method to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Using this method, we propose various techniques to generate either fixed-length or variable-length patterns. We show the advantages and drawbacks of each technique, based on the results of the experiments we have run on our testbed.

Original language	English (US)
Title of host publication	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Publisher	Springer [email protected]
Pages	1-15
Number of pages	15
ISBN (Print)	3540650040
DOIs	https://doi.org/10.1007/BFb0055852
State	Published - Jan 1 1998
Externally published	Yes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-12

Access to Document

10.1007/BFb0055852

Cite this

@inproceedings{052b75bdec554732a8b81649e085dbf1,

title = "Fixed vs. Variable-length patterns for detecting suspicious process behavior",

abstract = "This paper addresses the problem of creating patterns that can be used to model the normal behavior of a given process. These models can be used for intrusion detection purposes. In a previous work, we presented a novel method to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Using this method, we propose various techniques to generate either fixed-length or variable-length patterns. We show the advantages and drawbacks of each technique, based on the results of the experiments we have run on our testbed.",

author = "Herv{\'e} Debar and Marc Dacier and Mehdi Nassehi and Andreas Wespi",

note = "Generated from Scopus record by KAUST IRTS on 2022-09-12",

year = "1998",

month = jan,

day = "1",

doi = "10.1007/BFb0055852",

language = "English (US)",

isbn = "3540650040",

pages = "1--15",

booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer [email protected]",

}

Fixed vs. Variable-length patterns for detecting suspicious process behavior. / Debar, Hervé; Dacier, Marc; Nassehi, Mehdi et al.
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Springer [email protected], 1998. p. 1-15.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Fixed vs. Variable-length patterns for detecting suspicious process behavior

AU - Debar, Hervé

AU - Dacier, Marc

AU - Nassehi, Mehdi

AU - Wespi, Andreas

N1 - Generated from Scopus record by KAUST IRTS on 2022-09-12

PY - 1998/1/1

Y1 - 1998/1/1

N2 - This paper addresses the problem of creating patterns that can be used to model the normal behavior of a given process. These models can be used for intrusion detection purposes. In a previous work, we presented a novel method to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Using this method, we propose various techniques to generate either fixed-length or variable-length patterns. We show the advantages and drawbacks of each technique, based on the results of the experiments we have run on our testbed.

AB - This paper addresses the problem of creating patterns that can be used to model the normal behavior of a given process. These models can be used for intrusion detection purposes. In a previous work, we presented a novel method to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Using this method, we propose various techniques to generate either fixed-length or variable-length patterns. We show the advantages and drawbacks of each technique, based on the results of the experiments we have run on our testbed.

UR - http://link.springer.com/10.1007/BFb0055852

UR - http://www.scopus.com/inward/record.url?scp=84958752009&partnerID=8YFLogxK

U2 - 10.1007/BFb0055852

DO - 10.1007/BFb0055852

M3 - Conference contribution

SN - 3540650040

SP - 1

EP - 15

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

PB - Springer [email protected]

ER -

Fixed vs. Variable-length patterns for detecting suspicious process behavior

Abstract

Bibliographical note

Access to Document

Other files and links

Fingerprint

Cite this