A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection

Jiankun Hu, Xinghuo Yu, Dong Qiu, Hsiao Hwa Chen

Research output: Contribution to journalArticlepeer-review

135 Citations (Scopus)


Extensive research activities have been observed on network-based intrusion detection systems (IDSs). However, there are always some attacks that penetrate trafficprofiling- based network IDSs. These attacks often cause very serious damages such as modifying host critical files. A host-based anomaly IDS is an effective complement to the network IDS in addressing this issue. This article proposes a simple data preprocessing approach to speed up a hidden Markov model (HMM) training for system-call-based anomaly intrusion detection. Experiments based on a public database demonstrate that this data preprocessing approach can reduce training time by up to 50 percent with unnoticeable intrusion detection performance degradation, compared to a conventional batch HMM training scheme. More than 58 percent data reduction has been observed compared to our prior incremental HMM training scheme. Although this maximum gain incurs more degradation of false alarm rate performance, the resulting performance is still reasonable.

Original languageEnglish
Pages (from-to)42-47
Number of pages6
JournalIEEE Network
Issue number1
Publication statusPublished - 2009

All Science Journal Classification (ASJC) codes

  • Software
  • Information Systems
  • Hardware and Architecture
  • Computer Networks and Communications


Dive into the research topics of 'A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection'. Together they form a unique fingerprint.

Cite this