Modeling host status transition for network intrusion detection

Abstract

Most of the current network intrusion detection schemes are based on knowledge created through humans' interpretation. This kind of approaches are not capable to detect unknown intrusions. Herein, to overcome that limitation, we propose an intelligent intrusion detection scheme that doesn't depend on humans' analysis. Understanding intrusions as processes that make the host system's computing and network resources unavailable, it can be possible to identify unknown intrusions without pre-knowledge on that by predicting host system's resource usage trend. In this paper, we develop a model describable of host system's status in aspect of host resources availability and use that model to predict host system's future status according to network traffic flow.