AMarkovChainModelofTemporalBehaviorfor-LAAS.PDFVIP

WA1-1 8:00 Proceedings of the 2000 IEEE Workshop on Information Assurance and Security United States Military Academy, West Point, NY, 6-7 June, 2000 A Markov Chain Model of Temporal Behavior for Anomaly Detection Nong Ye Department of Industrial Engineering Arizona State University Tempe, Arizona, USA Email: nongye@asu.edu Abstract Section 3 defines the intrusion detection problem using the Markov chain model. Section 4 presents This paper presents an anomaly detection technique to detect intrusions into computer and network systems. In and discusses the results of testing the technique. this technique, a Markov chain model is used to represent a temporal profile of normal behavior in a computer and 2 Markov Chain Model network system. The Markov chain model of the norm A discrete-time stochastic process specifies how a profile is learned from historic data of the system ’s normal behavior. The observed behavior of the system is analyzed random variable changes at discrete points in time.