A Temporal Pattern Mining Based Approach for Intrusion Detection Using Similarity Measure

Abstract

In this paper, the major objective is to identify the intrusion using temporal pattern mining. The idea is to find the normal system call patterns and use these patterns to identify abnormal system call patterns. For finding the normal system calls we use the concept of association patterns and find the temporal association patterns. The reference sequence is used to obtain the temporal association patterns satisfying the user defined threshold. To find the temporal association system call patterns, we apply our novel procedure which performs only a single database scan. This reduces the extra overhead in generating the frequent system call patterns minimizing the space complexity. To find the similarity or dissimilarity values we use our proposed measure. The results show that the proposed approach overcomes the disadvantages of the traditional distance measures.