Statistical anomaly detection via httpd data analysis

摘要

The use of statistical anomaly detection for the purpose of computer intrusion detection is introduced, and a data analytic approach to the problem is illustrated. A preliminary study of the http daemon is used to demonstrate some of the more elementary yet informative investigations that can be carried out. We describe a sequence of findings of regularities in processes that the daemon creates, and in the system calls that comprise these processes that seem potentially useful in constructing an intrusion detection system based on traces of the daemon. General tools for studying the process traces are described.