Methods for Increasing Creditability of Anomaly Detection System

摘要

Based on Bayes' theorem we point out that the false positive rate must he lower than the intrusion base rate in order to make the Alarm Credibility Probability of the intrusion detection system exceed 50%. We present the methods that have been used inour developing intrusion detection system AIIDS (artificial immune intrusion detection systems) to increase the crcditability of anomaly detection system. These methods include increasing the regularities of the system call trace by use of Hidden MarkovModel (HMM), making every antibody or detector has finite lifetime, offering the detector a co-stimulate signal to illustrate whether there is damage in the system according to the integrity, confidentiality, or availability of the system resource.