A fast computer intrusion detection algorithm based on hypothesis testing of command transition probabilities
William DuMouchel, Matthias Schonlau · 1998
This statistical method compares in real time the sequence of commands given by each user to a profile of that user’s past behavior. We use the Fisher score statistic to test the null hypothesis that the observed command transition probabilities come from a profiled transition matrix. The alternative hypothesis is formed from a principal components analysis of historical differences between the transition probabilities of all other users and those of the user being tested. The calculations can be structured so that only a few dozen arithmetic operations are needed to update an online test statistic after each submitted command. The theoretical statistical properties of the test,