Intrusion Detection Using Text Processing Techniques with a Binary-Weighted Cosine Metric
Sanjay Rawat, Ved Prakash Gulati, Arun K. Pujari, V. Rao Vemuri · Bristol Research (University of Bristol) · 2006
This paper introduces a new similarity mea- sure, termed Binary Weighted Cosine (BWC) metric, for anomaly-based intrusion detection schemes that rely on using sequences of system calls. The new similarity measure con- siders both the number of shared system calls between two processes as well as frequencies of those calls. The k nearest neighbor (kNN) classifier is used to categorize a process as either normal or abnormal. The proposed BWC metric en- hances the capabilities of simple kNN classifier significantly - especially in the context of intrusion detection. The exper- imental results obtained from 1998 DARPA Data, are very promising and show that the proposed scheme results in a high detection rate and low false positive rate.