Intrusion Detection Using the Improved Weight Tree
Yi Yue · Microcomputer Development · 2004
An improved method for anomaly intrusion detection is brought forward in this paper. The data structure is the weight tree improved based on hamming distance. Firstly, build the normal weight tree forest using normal system calls trace. Secondly, prune off some branches based on hamming distance, and the frequent sequences of system calls remain. During intrusion detecting, scan abnormal trace using the normal weight tree and get corresponding weight sequence, on which make decision whether it is abnormal or not. At the same time pay attention to making good use of experience and updating experience. The method not only can detect intrusion but also can work in real live network environment.