Intrusion Detection A Text Mining Based Approach

TL;DR

This paper proposes a text mining approach for intrusion detection by designing a novel similarity measure based on system call analysis, aiming to improve detection accuracy in cybersecurity.

Contribution

It introduces a new distance measure tailored for intrusion detection using system call sequences, along with a framework for implementing this approach.

Findings

Designed a Gaussian-based similarity function for system call analysis

Developed a framework for intrusion detection using text mining techniques

Demonstrated potential for improved detection accuracy

Abstract

Intrusion Detection is one of major threats for organization. The approach of intrusion detection using text processing has been one of research interests which is gaining significant importance from researchers. In text mining based approach for intrusion detection, system calls serve as source for mining and predicting possibility of intrusion or attack. When an application runs, there might be several system calls which are initiated in the background. These system calls form the strong basis and the deciding factor for intrusion detection. In this paper, we mainly discuss the approach for intrusion detection by designing a distance measure which is designed by taking into consideration the conventional Gaussian function and modified to suit the need for similarity function. A Framework for intrusion detection is also discussed as part of this research.