Host state representation for intrusion detection

Abstract

Most of the current intrusion detection schemes are based on knowledge created through humans' interpretation. This kind of approaches is not capable to detect unknown intrusion. To over-come that limitation, we propose an intelligent intrusion detection scheme that doesn't depend on humans' analysis. Understanding intrusion as process that makes the host system's computing and network resources unavailable, it can be possible to identify unknown intrusion without pre-knowledge on that by predicting host system's state in aspect of its resource usage. We are developing a model which is describable of host system's state and used to predict host system's state as a fundamental step of this state aware IDS. In this paper, we show the basic idea of designing this model.