Multivariate statistical analysis of audit trails for host-based intrusion detection

• Published in: IEEE transactions on computers 2002-07, Vol.51 (7), p.810-820
• Main Authors: Ye, N., Emran, S.M., Chen, Q., Vilbert, S.
• Format: Article
• Language: English
• Subjects: Anomalies; Authentication; Complement; Cryptography; False alarms; Information security; Information systems; Intrusion; Intrusion detection; Management information systems; Norms; Power system security; Quality control; Statistical analysis; Studies; Testing
• ISSN: 0018-9340; 1557-9956
• DOI: 10.1109/TC.2002.1017701

Intrusion detection complements prevention mechanisms, such as firewalls, cryptography, and authentication, to capture intrusions into an information system while they are acting on the information system. Our study investigates a multivariate quality control technique to detect intrusions by building a long-term profile of normal activities in information systems (norm profile) and using the norm profile to detect anomalies. The multivariate quality control technique is based on Hotelling's T/sup 2/ test that detects both counterrelationship anomalies and mean-shift anomalies. The performance of the Hotelling's T/sup 2/ test is examined on two sets of computer audit data: a small data set and a large multiday data set. Both data sets contain sessions of normal and intrusive activities. For the small data set, the Hotelling's T/sup 2/ test signals all the intrusion sessions and produces no false alarms for the normal sessions. For the large data set, the Hotelling's T/sup 2/ test signals 92 percent of the intrusion sessions while producing no false alarms for the normal sessions. The performance of the Hotelling's T/sup 2/ test is also compared with the performance of a more scalable multivariate technique-a chi-squared distance test.