A nonparametric pattern recognition approach to anomaly detection
Linda Bright Lankewicz · 1992
A model for an anomaly detection system is developed which characterizes the behavior of user processes in an operating system in order to recognize abnormal activity which might indicate an intrusion or other threat to system security. Nonparametric pattern recognition techniques are used to characterize behavior, reducing the data associated with each image execution by a user to a vector in the resource usage space. Patterns of resource usage are identified and incorporated into profiles which serve as baselines for comparison in order to detect anomalies. A metric is provided for assessing the current behavior of a user compared to the historic profile. The metric produces a scaled assessment of the degree of abnormality of the activity for the user and serves as a measure of the threat to security. The model includes a policy of profile modification in order to effectively manage profiles as legitimate user activities change.