Abstract: Intrusion detection is important in the defense-in-depth network security framework. This paper presents an effective method for anomaly intrusion detection with low overhead and high efficiency. The method is based on rough set theory to extract a set of detection rules with a minimal size as the normal behavior model from the system call sequences generated during the normal execution of a process. It is capable of detecting the abnormal operating status of a process and thus reporting a possible intrusion. Compared with other methods, the method requires a smaller size of training data set and less effort to collect training data and is more suitable for real-time detection. Empirical results show that the method is promising in terms of detection accuracy, required training data set and efficiency.
['Zhongmin Cai', 'Xiaohong Guan', 'Ping Shao', 'Qingke Peng', 'Guoji Sun']
A rough set theory based method for anomaly intrusion detection in computer network systems