Intrusion Detection with Support Vector Machines and Generative Models
Baras, John S.
MetadataShow full item record
This paper addresses the task of detecting intrusions in the form of malicious programs on a host computer system by inspecting the trace of system calls made by these programs. We use "attack-tree" type generative models for such intrusions to select features that are used by a Support Vector Machine Classifier. Our approach combines the ability of an HMM generative model to handle variable-length strings, i.e. the traces, and the non-asymptotic nature of Support Vector Machines that permits them to work well with small training sets.