Automated discovery of concise predictive rules for intrusion detection.
This paper details an essential component of a multi-agent distributed knowledge network system for intrusion detection. We describe a distributed intrusion detection architecture, complete with a data warehouse and mobile and stationary agents for distributed problem-solving to facilitate building, monitoring, and analyzing global, spatio-temporal views of intrusions on large distributed systems. An agent for the intrusion detection system, which uses a machine learning approach to automated discovery of concise rules from system call traces, is described.We use a feature vector representation to describe the system calls executed by privileged processes. The feature vectors are labeled as good or bad depending on whether or not they were executed during an observed attack. A rule learning algorithm is then used to induce rules that can be used to monitor the system and detect potential intrusions. We study the performance of the rule learning algorithm on this task with and without feature subset selection using a genetic algorithm. Feature subset selection is shown to significantly reduce the number of features used while improving the accuracy of predictions.
The AAFID group at Purdues COAST project has
prototyped an agent-based intrusion detection system.
Their paper analyzes the agent-based approach to intrusion
detection and mentions the prototype work that
has been done on AAFID (Balasubramaniyan et al.,
1998). Our project diers from AAFID in that we are
using data mining to detect intrusions on multiple
components, emphasizing the use of learning algorithms
in intrusion detection, and using mobile agents. AAFID
is implemented in Perl while our system is implemented
in Java.
3. Design of our agent-based system
A system of intelligent agents using collaborative information
and mobile agent technologies (Bradshaw,
1997; Nwana, 1996) is developed to implement an intrusion
detection system (Denning, 1987).
The goals of the system design are to:
Learn to detect intrusions on hosts and networks using
individual agents targeted at particular subsystems

Use mobile agent technologies to intelligently process
audit data at the sources;
Have agents collaborate to share information on suspicious
events and determine when to be more vigilant
or more relaxed;
Apply data mining techniques to the heterogeneous
data and knowledge sources to identify and react to
coordinated intrusions on multiple subsystems.
A notable feature of the intrusion detection system
based on data mining is the support it oers for gathering
and operating on data and knowledge sources
from the entire observed system. The system could
identify sources of concerted or multistage intrusions,
initiate countermeasures in response to the intrusion,
and provide supporting documentation for system administrators
that would help in procedural or legal action
taken against the attacker.
An example of an intrusion involving more than one
subsystem would be a combined NFS and rlogin intru-
sion. In the first step, an attacker would determine an
NFS filehandle for an .rhosts file or /etc/hosts.equiv
(assuming the appropriate filesystems are exported by the
UNIX system) (van Doorn, 1999). Using the NFS file-
handle, the attacker would re-write the file to give himself
login privileges to the attacked host. Then, using rlogin
from the formerly untrusted host, the attacker would be
able to login to an account on the attacked host, since the
attacked host now mistakenly trusts the attacker. At this
point, the attacker may be able to further compromise
the system. The intrusion detection system based on data
mining would be able to correlate these intrusions, help
to identify the origin of the intrusion, and support system
management in responding to the intrusion. The components
of the agent-based intrusion detection system are
shown in Fig. 1. Information routers read log files and
monitor operational aspects of the systems. The information
routers provide data to the distributed data
cleaning agents who have registered their interest in
particular data. The data cleaning agents process data
obtained from log files, network protocol monitors, and
system activity monitors into homogeneous formats. The
mobile agents, just above the data cleaning agents in the
system architecture, form the first level of intrusion de-
tection. The mobile agents travel to each of their associated
data cleaning agents, gather recent information,
and classify the data to determine whether suspicious
activity is occurring.
Like the JAMsystem (Stolfo et al., 1997), the low-level
agents may use a variety of classification algo-
rithms. Unlike the JAMsystem, though, the agents at
this level will collaborate to set their suspicion level to
determine cooperatively whether a suspicious action is
more interesting in the presence of other suspicious activity

Fig. 1. Architecture of the intrusion detection system.
At the top level, high-level agents maintain the data
warehouse by combining knowledge and data from the
low-level agents. The high-level agents apply data mining
algorithms to discover associations and patterns.
Because the data warehouse provides a global, temporal
view of the knowledge and activity of the monitored
distributed system, this system could help train system
administrators to spot and defend intrusions. Our system
could also assist system administrators in developing
better protections and countermeasures for their
systems and identifying new intrusions.
The interface agent for the agent-based intrusion
detection system directs the operation of the agents in
the system and maintains the status reported by the
mobile agents. The interface agent also provides access
to the data warehouse features.
In our projects current state, several data cleaning
and low-level agents have been implemented. This paper
discusses the agent that monitors privileged programs
using machine learning techniques. Our work in progress
includes the integration of data-driven knowledge
discovery agents into a distributed knowledge network
for monitoring distributed computing systems. In gen-
eral, we are interested in machine learning approaches to
discovering patterns of coordinated intrusions on a
system wherein individual intrusions are spread over
space and time.
4. Rule learning from system call traces
Programs that provide network services in distributed
computing systems often execute with special privileges.
For example, the popular sendmail mail transfer agent
operates with superuser privileges on UNIX systems.
Privileged programs like sendmail are often a target for
intrusions.
The trace of system calls executed by a program can
identify whether an intrusion was mounted against a
program (Forrest et al., 1996; Lee and Stolfo, 1998).
Forrests project at the University of New Mexico
(Forrest et al., 1996) developed databases of system calls
from normal and anomalous uses of privileged programs
such as sendmail. Forrests system call data is a
set of files consisting of lines giving a process ID number
(PID) and system call number. The files are partitioned
based on whether they show behavior of normal or
anomalous use of the privileged sendmail program
running on SunOS 4.1.
Forrest organized system call traces into sequence
windows to provide context. Forrest showed that a
database of known good sequence windows can be developed
from a reasonably sized set of non-intrusive
sendmail executions. Forrest then showed that intrusive
behavior can be determined by finding the percentage of
system call sequences that do not match any of the
known good sequences. The data sets that were used by
Forrests project are available in electronic form on their
Web site (Forrest, 1999). We use the same data set to
enable comparison with techniques used in related papers
(Lee and Stolfo, 1998; Warrender et al., 1999).
Our feature vector technique improves on Forrests
technique because it does not depend on a threshold
percentage of abnormal sequences. Our feature vector
technique compactly summarizes the vast data obtained
from each process, enabling longer-term storage of the
data for reference and analysis. With respect to other
rule learning techniques, our technique induces a compact
rule set that is easily carried in lightweight agents.
Our technique also may mine knowledge from the data
in a way that can be analyzed by experts.
Lee and Stolfo (1998) used a portion of the data from
Forrests project to show that the RIPPER (Cohen,
learning algorithm could learn rules from system
call sequence windows. Lee empirically found sequences
of length 7 and 11 gave the best results in his experiments
(Lee and Stolfo, 1998). For training, each window
is assigned a label of normal if it matches one of the
good windows obtained from proper operations of
sendmail; otherwise, the window is labeled as abnor-
mal. An example of the system call windows and labels
are shown in Table 1. After RIPPER is trained, the
learned rule set is applied to the testing data to generate
classifications for each sequence window. Lee uses a
window across the classifications of length 2L  1, where
L is the step size for the window, to group labels (Lee
and Stolfo, 1998). If the number of abnormal labels in
the window exceeds L, the window is considered ab-
normal. An example of a single window over the clas-
sifications is shown in Table 2.
The window scheme filters isolated noise due to occasional
prediction errors. When an intrusion takes

Table
Sample system call windows with training labels
System call sequences Label
4, 2, 66, 66, 4, 138, 66 Normal
2, 66, 66, 4, 138, 66, 5 Normal
66, 66, 4, 138, 66, 5, 5 Normal
66, 4, 138, 66, 5, 5, 4 Abnormal
4, 138, 66, 5, 5, 4, 39 Abnormal

Table
Sample system call windows with classifications
RIPPERs System call sequences Actual label
classification
Normal 4, 2, 66, 66, 4, 138, 66 Normal
Normal 2, 66, 66, 4, 138, 66, 5 Normal
Abnormal 66, 66, 4, 138, 66, 5, 5 Normal
Abnormal 66, 4, 138, 66, 5, 5, 4 Abnormal
Abnormal 4, 138, 66, 5, 5, 4, 39 Abnormal
place, a cluster of system call sequences will usually be
classified abnormal. In Table 2, since there are more
abnormal classifications than normal in this window,
then this entire window is labeled anomalous. Lee empirically
found that values of L  3andL  5 worked
best for identifying intrusions (Lee and Stolfo, 1998).
Finally, when the window has passed over all the
classifications, the percentage of abnormal regions is
obtained by dividing the number of anomalous windows
by the total number of windows. Lee uses this percentage
to empirically derive a threshold that separates
normal processes from anomalous processes. Warrender
et al. (1999) uses a similar technique, the Locality Frame
Count (LFC), that counts the number of mismatches in
a group and considers the group anomalous if the count
exceeds a threshold. Warrenders technique allows intrusion
detection for long-running daemons, where an
intrusion could be masked by a large number of normal
windows with Lees technique.
Lee and Stolfo (1998) developed an alternate technique
that predicts one of the system calls in a sequence.
The alternate technique allows learning of normal behavior
in the absence of anomalous data. Our technique
is less suitable in that is does require anomalous data for
training.
5. Representing system call traces withfeature vectors
One of the goals of automated discovery of predictive
rules for intrusion detection is to extract the relevant
knowledge in a form that lends itself to further analysis
by human experts. A natural question that was raised by
examination of the rules learned by RIPPER (Cohen,
1995) in the experiments of Lee and Stolfo (1998) and
Helmer et al. (1998) was whether essentially the same
performance could be achieved by an alternative approach
that induced a smaller number of simpler rules.
To explore this question, we designed an alternative
representation scheme for the data. This representation
was inspired by the success of the bag of words representation
of documents (Salton, 1983) that has been
successfully used by several groups to train text classi-
fication systems (Yang et al., 1998). In this representa-
tion, each document is represented using a vector whose
elements correspond to words in the vocabulary. In the
simplest case, the vectors are binary and a bit value of 1
indicates that the corresponding word appears in the
document in question and bit value of 0 denotes the
absence of the word.
In this experiment, the data were encoded as binary-valued
bits in feature vectors. Each bit in the vector is
used to indicate whether a known system call sequence
appeared during the execution of a process. This encoding
is similar in spirit to the bag of words encoding
used to represent text documents.
Feature vectors were computed on a per-process basis
from the sendmail system call traces (Forrest, 1999).
Based on ideas from previous work (Forrest et al., 1996;
Lee and Stolfo, 1998), sequence windows of size 5-12
were evaluated for use with our feature vector approach.
Sequence windows of size 7 were selected for their good
performance in learning accuracy and relatively small
dictionary size.
The training data was composed of 80% of the feature
vectors randomly selected from normal traces and
all of the feature vectors from the selected abnormal
traces. To compare our results to those from the JAM
project, four specific anomalous traces were selected for
training. Five dierent selections of anomalous traces
were also tested to ensure that arbitrarily selecting these
four anomalous traces did not significantly aect the
results.
The number of abnormal records in the training data
was quite small (15 records) in proportion to the set of
normal training data (520 records). To balance the
weightings, the abnormal training data was duplicated
36 times so that 540 abnormal records were present in
the training data. Lee and Stolfo (1998) explains the
rationale for balancing the data to obtain the desired
results from RIPPER. From the feature vectors built
from sequences of length 7, RIPPER eciently learned a
rule set containing seven simple rules:
good IF a1406  t
good if a67  t
good if a65  t
good if a576  t
good if a132  t
good if a1608  t
bad otherwise
The size of this set of rules compares favorably to the set
of 209 rules RIPPER learned when we used Lees system
call window approach. The feature vector approach
condenses information about an entire process history
of execution. Feature vectors may make it easier for
learning algorithms by aggregating information over the
entire execution of a process rather than by looking at
individual sequences.
Applying the learned rule set produced the results
shown in Table 3. All traces except Normal sendmail
are anomalous. Boldface traces were used for training.
The total numbers of feature vectors, numbers of vectors
predicted abnormal by RIPPER, and detection results
are shown. Since a single feature vector represents
each process, each trace tends to have few feature vectors

The rules cannot be expected to flag all of the processes
in an attacked trace as an intrusion. While handling
a mail message, sendmail spawns child processes
that handle dierent parts of the procedures involved in
receiving, queuing, and forwarding or delivering the
message. Some of these processes involved in handling
Table
Results of learning rules for feature vectors
Trace name Total Vectors Attack
feature predicted detected?
vectors abnormal
chasin 6 3 Y
recursive
smdhole
Normal sendmail 130 3
(not used for
training)
an intrusive transaction may be indistinguishable from
processes handling a normal transaction because the
attack only aects one of the processes. Therefore, if at
least one of the processes involved in an intrusion is
flagged as abnormal, we can identify the group of related
processes as anomalous.
Several attacks did not result in successful intrusions.
For our intrusion detection system, we identify all attacks
as intrusive activity that merits further investigation
elsewhere in the IDS. It would be unlikely that an
attacker would attempt a single exploit and give up if it
fails. The data mining portion of our intrusion detection
system would then correlate these multiple (successful
and unsuccessful) attacks.
The anomalous traces are clearly identified in our
experiment with the exception of one of the minor in-
trusions, fwd-loops-2. The fwd-loop attacks are denial-
of-service attacks where the sendmail process spends its
time repeatedly forwarding the same message. The feature
vector technique may need to be adjusted from
simple binary values to statistical measures to identify
this class of attack.
A benefit of the feature vector approach is the simplicity
of the learned rules. Training takes place
line due to the amount of time need to learn a rule set.
Each learned rule set for the sendmail system call feature
vectors is simple: generally fewer than 10 rules, where
each rule often consists of a conjunction of one or two
Boolean terms. Such a small set of rules applied to this
simple data structure should allow us to use this approach
in a near real-time intrusion detection agent
without placing an excessive load on a system. A small,
simple rule set also may lend itself to human expert
examination and analysis in data mining situations
(Cabena et al., 1998).
Another benefit of the feature vector approach is the
condensed representation of a process by its fixed-length
feature vector. The list of system calls executed by a
process can be enormous. Storing this information in its
entirety is infeasible. Representing the data by a relatively
short fixed-length string helps solve the problems
of transmitting and storing the data. This technique
realizes the mobile agent architectures goal of reducing
and summarizing data at the point of generation.
6. Feature subset selection using genetic algorithms
A learning algorithms performance in terms of
learning time, classification accuracy on test data, and
comprehensibility of the learned rules often depends on
the features or attributes used to represent the examples.
Feature subset selection has been shown to improve the
performance of a learning algorithm and reduce the effort
and amount of data required for machine learning
on a broad range of problems (Liu and Motoda, 1998).
A discussion of alternative approaches to feature subset
selection can be found in John et al. (1994), Yang and
Honavar (1998), Liu and Motoda (1998).
The benefits and aects of feature subset selection
include:
Feature subset selection aects the accuracy of a
learning algorithm because the features of a data set
represent a language. If the language is not expressive
enough, the accuracy of any learning algorithm is adversely
aected.
Feature subset selection reduces the computational
eort required by a learning algorithm. The size of
the search space depends on the features; reducing
the feature set to exclude irrelevant features reduces
the size of the search space and thus reduces the
learning eort.
The number of examples required to learn a classifi-
cation function depends on the number of features
(Langley, 1995; Mitchell, 1997). More features require
more examples to learn a classification function
to a desired accuracy.
Feature subset selection can also result in lower cost
of classification (because of the cost of obtaining feature
values through measurement or simply the computation
overhead of processing the features).
Against this background, it is natural to consider feature
subset selection as a possible means of improving the
performance of machine learning algorithms for intrusion
detection
Genetic algorithms and related approaches (Gold-
berg, 1989; Michalewicz, 1996; Koza, 1992) oer an
attractive alternative to exhaustive search (which is infeasible
in most cases due to its computational com-
plexity). They also have an advantage over commonly
used heuristic search algorithms that rely on the monotonicity
assumption (i.e., addition of features does not
worsen classification accuracy) which is often violated in
practice (Yang and Honavar, 1998).
The genetic algorithm for feature subset selection
starts with a randomly generated population of indi-
viduals, where each individual corresponds to a candidate
feature subset. Each individual is encoded as a
string of 0s and 1s. The number of bits in the string is
equal to the total number of features. A 1 in the bit
string indicates an attribute is to be used for training,
and a 0 indicates that the attribute should not be used
for training. The fitness of a feature subset is measured
by the test accuracy (or cross-validation accuracy of the
classifier learned using the feature subset) and any other
criteria of interest (e.g., number of features used, the
complexity of the rules learned).
We used the RIPPER rule learning algorithm as the
classifier. The training data is provided to RIPPER,
which learns a rule set from the data. The number of
conditions in the learned rule set is counted, and this
value is used to determine the complexity of the learned
hypothesis. The learned rule set is applied to the test
examples and the determined accuracy is returned to the
feature subset selection routine. The fitness of the individual
is calculated, based on the accuracy of the learned
hypothesis (accuracyx), the number of attributes
(costx) used in learning, the complexity of the learned
hypothesis (complexityx), and weights (waccuracy, wcost,
wcomplexity) for each parameter:
fitnessxwaccuracy accuracyxwcost costx
wcomplexity complexityx:
This fitness is then used to rank the individuals for se-
lection. Other methods of computing fitness are possible
and are discussed by Yang and Honavar (1998).
A primary goal in using feature subset selection on
this intrusion detection problem is to improve accuracy.
A high percentage of the intrusion detection alerts reported
by current intrusion detection systems are false
alarms. Our system needs to be highly reliable, and we
would like to keep false alarms to a minimum. A secondary
goal is to reduce the amount of data that must
be obtained from running processes and classified. This
would reduce the overhead of our intrusion detection
approach on the monitored system.
6.1. Feature subset selection results
The genetic algorithm used standard mutation and
crossover operators with 0.001 probability of mutation
and 0.6 probability of crossover with rank-based selec-
Table
Feature subset selection results with constant parameters
Trial Training accuracy of Attributes used by
best individual best individual
tion (Goldberg, 1989). The probability of selecting the
best individual was 0.6. A population size of 50 was used
and each run went through five generations.
We started with the training data used for the previous
feature vector experiment (1060 feature vectors).
We added an additional copy of each unique feature
vector in the training data (72 feature vectors) to ensure
that rare but potentially important cases had a reason-able
probability of being sampled in the training and
testing phases. This gave a total of 1132 feature vectors
in the input to the genetic algorithm.
To show the general eectiveness of genetic feature
selection on this problem, Table 4 shows the results of
five separate runs of the genetic algorithm with RIPPER
with identical parameters used for each run. The number
of attributes is significantly reduced while the accuracy is
maintained.

Table

5 shows the results of using the rules from the
best individuals found in the five genetic feature selection
runs and compares the results to the original results
learned from all the features. All traces except Normal
sendmail are intrusions. Boldface traces were used for
training. Despite using only about half the features in
the original data set, the performance of the learned
rules was comparable to that obtained using the entire
set of features. After feature subset selection, none of the
feature vectors from normal sendmail are labeled as
abnormal. This shows an improvement in the rate of
false positives.
7. Analysis
A comparison of the eectiveness of RIPPER on the
problem using two dierent data representations and
genetic feature selection algorithm follows.

Table

6 illustrates the advantages of the feature vector
representation over the system call windows for this
learning problem. The feature vector representation allows
the learning algorithm to learn a hypothesis much
faster and with comparable accuracy on the normal test
data, and the complexity of the hypothesis is much
smaller. Using genetic feature selection on the feature
vectors is time consuming but further improves the
learned hypothesis and reduces the set of attributes used
for learning.
Table
Results from rules learned by genetic feature selection
Trace All attributes Trial 1 Trial 2 Trial 3 Trial 4 Trial 5
chasin Y YYYYY
recursive Y YYYYY
smdhole Y YYYYY
Normal sendmail 1/120 0/120 0/120 0/120 0/120 0/120

Table
Eectiveness of dierent learning techniques
Measure Sequence windows Feature vectors Genetic algorithm feature selection
Learning eort Moderate (30 min) Very good (under 1 min) Intensive (approx. 4 h)
Accuracy of learned hypothesis Good (0.53% false positive) Good (0.83% false positive) Very good (0% false positive)
Complexity of learned hypothesis Poor (Avg. 225 rules) Good (4 rules, 7 tests) Good (Avg. 8.6 rules, 9.6 tests)
Number of attributes used 7 (7 system calls in window) 1832 Avg. 848.9
Classification eort Moderate (large rule set) Small (trivial rule set) Smaller (trivial rule set, fewer features)
7.1. Rules learned by RIPPER
An example set of rules that were learned in first trial
of RIPPER with genetic feature subset selection is
shown below:
good IF a1024  t.
good IF a27  t.
good IF a873  f AND a130  f.
good IF a12  t.
good IF a191  t.
good IF a223  t.
good IF a327  t.
bad IF.
The set above contains eight individual rules composed
of eight tests, which correspond to this pseudo-code

IF \unlink,close,unlink,unlink,close,getti-
meofday,open" seen THEN good
link,rename" seen THEN good
sigsetmask,sigblock,sigvec" not seen and
\close,setitimer,close,gettimeofday,link,
socket,fcntl" not seen THEN good
accept,fork" seen THEN good
accept,fork,close" seen THEN good
getdents" seen THEN good
accept,close" seen THEN good
Each of the rule sets from the five genetic algorithm
trials contains rules that can be found in the other rule
sets. The third and fourth trials contain mostly unique
rules, while the other three runs contain a majority of
rules that are duplicated in other rule sets. The similarities
of rules between runs likely indicates the
strength of particular sequences in identifying normal
behavior.
Because the rule sets identify normal processes and
consider all others abnormal, none of the rules identifies
particular abnormal system call sequences. Conse-
quently, the rules do not identify system call sequences
that would directly signal an intrusion. However, these
rules may lead to an understanding of how an attack
causes the typical sequence of system calls to change.
In general, the small size of the rules sets learned by
RIPPER from the system call feature vectors and the
performance of these learned rule sets indicates that a
concise set of rules clearly distinguish normal sendmail
processes from anomalous.
8. Conclusion and future work
Intrusion detection and abuse detection in computer
systems in networked environments is a problem
of great practical interest. This paper investigated the
classification of system call traces for intrusion detection
through the technique of describing each process
by a feature vector. From the feature vector
representation RIPPER learned a small, concise set of
rules that was successful at classifying intrusions. In
comparison with other techniques, the feature vector
representation does not depend on thresholds to separate
normal from anomalous. We are concerned that
establishing an arbitrary threshold is dicult and
would require tuning in practice to balance false
alarms (false positives) against missed intrusions (false
negatives).
The rule sets learned using the feature vector representation
are an order of magnitude simpler than
those obtained using other approaches reported in the
literature (Helmer et al., 1998; Lee and Stolfo, 1998).
This is especially noteworthy given the fact that all of
the experiments in question used the same rule learning
algorithm. We conjecture that the feature vector representation
used in our experiments is primarily responsible
for the dierences in the rule sets that are
learned. The feature vectors condense information
from the entire execution of a process compared to the
fine-grained detail of individual sequences. The scope
of information contained in the feature vectors may
make it easier for learning algorithms to learn simple
rules.
It was further shown that feature subset selection
reduced the number of features in the data, which
resulted in less data and eort required for training
due to the smaller search space. Feature selection also
gave equivalent accuracy with a smaller set of features

We have integrated the learned rules into a mobile
agent running on a distributed system consisting of
Pentium II systems running FreeBSD. This laboratory
network is connected by a firewall to the Department
of Computer Sciences network so we may
operate the intrusion detection system in a controlled
environment. For operation of the IDS, a Voyager
server is started on each host in the monitored distributed
system. The mobile agent is travel through
the system, classifies sample sendmail system call
feature vectors, and reports the results to its media-
tor. The mediator reports the results to the user interface
and optionally stores the information in a
database for potential mining and warehousing op-
erations. We have implemented a set of Java classes
that can interpret and apply the RIPPER rules,
which allows our mobile agent to bring its classifier
and rule set(s) with it as it travels through the distributed
system.
Open issues include the use of this technique in heterogeneous
distributed systems. Specific rule sets may
need to be developed for each node in a distributed
system due to variabilities between operating systems
and workload characteristics. Fortunately, the rule sets
discovered by RIPPER have been small, so mobile
agents ought to be able to carry multiple rule sets
without becoming overly heavy.
Another issue is whether this technique could be applied
in real time. Feature subset selection itself is
computationally expensive, so training and refining the
agent cannot be done in real time. After the agent is
trained, our technique can determine whether a process
is an intruder only after the process has finished, which
provides near real time detection. Warrender et al.
or Lee and Stolfo (1998) techniques would allow
anomaly detection in real time during the execution of
the process. Our technique could be refined to determine
the likelihood that a process is intrusive during the
process execution, giving real time detection. This re-
finement would be necessary for long-lived daemons
such as HTTP servers.
We would also like to know how well this technique
applies to privileged programs other than sendmail.
Warrender worked with five distinct privileged programs
and identified cases where dierent thresholds
and/or dierent algorithms worked better for dierent
programs (Warrender et al., 1999). Based on her work,
we expect this technique will be successful for more
programs than just sendmail.
Work in progress on intrusion detection is aimed at
the integration of data-driven knowledge discovery
agents into a distributed knowledge network for monitoring
and protection of distributed computing systems
and information infrastructures. The investigation of
machine learning approaches to discover patterns of
coordinated intrusions on a system wherein individual
intrusions are spread over space and time is of particular
interest in this context.

Acknowledgements

This work was supported by the Department of De-
fense. Thanks to the Computer Immune System Project
at the University of New Mexicos Computer Science
Department for the use of their sendmail system call
data.

--R


An Introduction to Software Agents.
Discovering Data Mining: From Concept to Implementation.
Fast e
An intrusion-detection model

computer immune systems data sets.
computer immunol- ogy

Artificial intelligence and intrusion detection: Current and future direction.
Genetic Algorithms in Search
The architecture of a network level intrusion detection system.
Intelligent agents for intrusion detection.
Distributed knowledge networks.
Irrelevant features and the subset selection problem.
Genetic Programming.
Elements of Machine Learning.
Data mining approaches for intrusion detection.
Feature Extraction
Genetic Programs Algorithms
Machine Learning.
Network intrusion detection.
Software agents: An overview.
ObjectSpace Inc
Open infrastructure for scalable intrusion detection.
Automated Text Processing.
JAM: Java agents for meta-learning over distributed databases

Detecting intrusions using system calls: alternative data models.
In
Mobile intelligent agents for document classification and retrieval: A machine learning approach.
Guy Helmer is a Senior Software Engineer at Palisade Systems
Johnny Wong is a Full Professor of the computer Science Department
Wong is also involved in the Coordinated Multimedia System (COMS) in Courseware Matrix Software Project



Les Miller is a professor and chair of computer Science at Iowa State University.
--TR
An intrusion-detection model
Automatic text processing
Elements of machine learning
Genetic algorithms data structures = evolution programs (3rd ed.)
Computer immunology
Software agents
Discovering data mining
Genetic Algorithms in Search, Optimization and Machine Learning
Machine Learning
Feature Extraction, Construction and Selection
A Sense of Self for Unix Processes

--CTR
Wun-Hwa Chen , Sheng-Hsun Hsu , Hwang-Pin Shen, Application of SVM and ANN for intrusion detection, Computers and Operations Research, v.32 n.10, p.2617-2634, October 2005
Ningning Wu , Jing Zhang, Factor-analysis based anomaly detection and clustering, Decision Support Systems, v.42 n.1, p.375-389, October 2006
Chi-Ho Tsang , Sam Kwong , Hanli Wang, Genetic-fuzzy rule mining approach and evaluation of feature selection techniques for anomaly intrusion detection, Pattern Recognition, v.40 n.9, p.2373-2391, September, 2007
Qingbo Yin , Rubo Zhang , Xueyao Li, An new intrusion detection method based on linear prediction, Proceedings of the 3rd international conference on Information security, November 14-16, 2004, Shanghai, China
intrusion detection;feature subset selection;machine learning