A nature inspired anomaly detection system using multiple detection engines

Jiang, F; Ling, SSH; Agbinya, JI

A nature inspired anomaly detection system using multiple detection engines

Jiang, F Ling, SSH

Agbinya, JI

Permalink

Publication Type:: Conference Proceeding
Citation:: IB2COM 2011 - 6th International Conference on Broadband Communications and Biomedical Applications, Program, 2011, pp. 200 - 205
Issue Date:: 2011-12-01

Closed Access

	Filename	Description	Size
	2011004449OK.pdf		655.74 kB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	Jiang, F	en_US
dc.contributor.author	Ling, SSH https://orcid.org/0000-0003-0849-5098	en_US
dc.contributor.author	Agbinya, JI	en_US
dc.date.issued	2011-12-01	en_US
dc.identifier.citation	IB2COM 2011 - 6th International Conference on Broadband Communications and Biomedical Applications, Program, 2011, pp. 200 - 205	en_US
dc.identifier.isbn	9781467307680	en_US
dc.identifier.uri	http://hdl.handle.net/10453/19170
dc.description.abstract	The rapid growth of computer networks presents challenges to the single detection engine based system, which has been insufficient in meeting end-users' requirements in the large-scale distributed complex network. In this paper, multiple detection engines with multi-layered intrusion detection mechanisms are proposed. The principle is to coordinate the results from each single-engine intrusion alert system, by seamlessly integrating with the multiple layered distributed service-oriented structure. An improved hidden Markov model (HMM) is created for the detection engine which is capable of the immunology-based self/nonself discrimination. The classifications of normal and abnormal behaviour of system calls are further examined by an advanced fuzzy-based inference process called HPSOWM. Considering a real benchmark dataset from the public domain, our experimental results show that the proposed scheme can greatly shorten the training time of HMM and reduce the false positive rate significantly. The proposed HPSOWM especially works for the efficient classification of unknown behaviors and malicious attacks. © 2011 IEEE.	en_US
dc.relation.ispartof	IB2COM 2011 - 6th International Conference on Broadband Communications and Biomedical Applications, Program	en_US
dc.relation.isbasedon	10.1109/IB2Com.2011.6217920	en_US
dc.title	A nature inspired anomaly detection system using multiple detection engines	en_US
dc.type	Conference Proceeding
utslib.for	0801 Artificial Intelligence and Image Processing	en_US
dc.location.activity	Melbourne, Australia	en_US
pubs.embargo.period	Not known	en_US
pubs.organisational-group	/University of Technology Sydney
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology/School of Biomedical Engineering
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology/School of Electrical and Data Engineering
pubs.organisational-group	/University of Technology Sydney/Provost
pubs.organisational-group	/University of Technology Sydney/Provost/Jumbunna
pubs.organisational-group	/University of Technology Sydney/Strength - CHT - Health Technologies
utslib.copyright.status	closed_access
pubs.publication-status	Published	en_US

Abstract:

The rapid growth of computer networks presents challenges to the single detection engine based system, which has been insufficient in meeting end-users' requirements in the large-scale distributed complex network. In this paper, multiple detection engines with multi-layered intrusion detection mechanisms are proposed. The principle is to coordinate the results from each single-engine intrusion alert system, by seamlessly integrating with the multiple layered distributed service-oriented structure. An improved hidden Markov model (HMM) is created for the detection engine which is capable of the immunology-based self/nonself discrimination. The classifications of normal and abnormal behaviour of system calls are further examined by an advanced fuzzy-based inference process called HPSOWM. Considering a real benchmark dataset from the public domain, our experimental results show that the proposed scheme can greatly shorten the training time of HMM and reduce the false positive rate significantly. The proposed HPSOWM especially works for the efficient classification of unknown behaviors and malicious attacks. © 2011 IEEE.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/19170