Intrusion Detection System Based on Probabilistic Suffix Tree

Abstract

A system is proposed to implement intrusion detection under Linux based on the probabilistic suffix tree model. We use a sliding window to segment the system call sequence, judge whether it is an abnormal sequence by the rarity of a single sequence, and realize the detection and early warning of intrusion threats. The original information security uses a rule-based method to deal with intrusion threats through feature signatures and manual analysis. However, we use big data analysis methods to identify abnormal system call sequences by building models and the whole spatiotemporal context analysis. Early warning of security threats can significantly reduce the overall cost and complexity of threat detection. Compared with traditional intrusion detection methods, our model uses normal call sequences for training, and the model also constantly updates itself during threat detection to prevent unknown threats. Through experiments, it is confirmed that the system has good accuracy and low response time and realizes intrusion detection and early warning to the greatest extent.