Viterbi algorithm for intrusion type identification in anomaly detection system

Abstract

Due to the proliferation of the infrastructure of communication networks and the development of the relevant technology, intrusions on computer systems and damage are increased, resulting in extensive work on intrusion detection systems (IDS) to find attacks exploiting illegal usages or misuses. However, many IDSs have some weaknesses, and most hackers try to intrude systems through the vulnerabilities. In this paper, we develop an intrusion detection system based on anomaly detection with hidden Markov model and propose a method using the Viterbi algorithm for identifying the type of intrusions. Experimental results indicate that the buffer overflow is well-identified, while we have some difficulties to identify the denial of service attacks with the proposed method. © Springer-Verlag 2004.