Please use this identifier to cite or link to this item: http://hdl.handle.net/1901/103
| Title: | Applying Term Weight Techniques to Event Log Analysis for Intrusion Detection |
| Authors: | John R. Reuning |
| Keyword: | Computer Security |
| Keyword: | Information Retrieval |
| Issue Date: | 20-Jul-2004 |
| Publisher: | School of Information and Library Science |
| Abstract: | Strong similarities exist between intrusion detection and information retrieval. This paper explores the application of probabilistic information retrieval techniques to log analysis for host-based intrusion detection. Using information retrieval techniques may yield significant improvements to the performance of intrusion detection systems. This paper provides a brief review of current relevant research in intrusion detection and log analysis, introduces information retrieval methods appropriate for intrusion detection, and evaluates the effectiveness an experimental log analysis system using the 1999 DARPA Intrusion Detection Evaluation data sets. The system is based on Bayesian probability theory and uses a TF-IDF term weight measure to identify anomalies. |
| URI: | http://hdl.handle.net/1901/103 |
| Appears in Collections: | SILS Master's Papers |
Files in This Item:
|
All items in SILS-ETD are protected by copyright, with all rights reserved.