Multi-Stage Intrusion Detection System Using Hidden Markov Model Algorithm
Dohyeon Lee, Doo-Young Kim, Jae-il Jung · 2008
Intrusion detection systems are the basis of system protection from network attacks. However, intrusions are increasingly taking multi-stage procedures to attack a system, and cannot be detected by existing single stage intrusion detection systems. This paper proposes a multi-stage intrusion detection system architecture using hidden Markov model algorithm. This system considers every stage used by recent intrusions and applies them to the hidden Markov model algorithm to determine which intrusion is used in the audit data. This architecture reduces overheads of intrusion agents and raises efficiency of the whole system.