Intrusion detection method based on hierarchical hidden Markov model and variable-length semantic pattern

Abstract

The defects of intrusion detection using fixed-length short system call sequences were analyzed. A method of extracting variable-length short system call sequences, grounded on the function return addresses stored in the process stacks, was proposed. Based on the hierarchical relationship and the state transition characteristics of the variable-length semantic patterns, a hierarchical hidden Markov intrusion detection model was presented. The experimental results show that the hierarchical hidden Markov intrusion detection model is superior to the traditional hidden Markov model.

Keywords

• intrusion detection;hierarchical hidden Markov model;system call;variable-length semantic pattern;process stack