Probabilistic techniques for intrusion detection based on computer audit data - Systems, Man and Cybernetics,

2266 IEEE TRANSACTIONS ON SYSTEMS, MAN, AND CYBERNETICS—PART A: SYSTEMS AND HUMANS, VOL. 31, NO. 4, JULY 2001Probabilistic Techniques for Intrusion DetectionBased on Computer Audit DataNong Ye, Member, IEEE, Xiangyang Li, Qiang Chen, Syed Masum Emran, and Mingming XuAbstract—This paper presents a series of studies on probabilistic traveling over communication links between host machines, andproperties of activity data in an information system for detecting thus capture activities over communication networks. Audit trailintrusions into the information system. Various probabilistic tech-data activities occurring on individual host machines.niques of intrusion detection, including decision tree, Hotelling’sActivity data of an information system contain not only usefulT test, chi-square multivariate test, and Markov chain are ap-plied to the same training set and the same testing set of computer information to uncover intrusive activities but also much irrele-audit data for investigating the frequency property and the or- vant information.dering property of computer audit data. The results of these studies This paper presents a series of studies performed at the In-provide answers to several questions concerning which propertiesformation and Systems Assurance Laboratory of Arizona Stateare critical to intrusion detection. First, our studies show that theUniversity to reveal a few probabilistic properties of computerfrequency property of multiple audit event ...