Adaptive Observation-Centric Anomaly-Based Intrusion Detection: Modeling, Analysis and Evaluation

Anomaly-based intrusion detection is about discrimination of malicious and legitimate patterns of activities (system or user-driven) in variables characterizing system normality. Due to the nonstationarity and increasingly complexity of today’s computer systems, perfect normality characterization is always deemed to be an unreachable goal for any anomaly detection model. Because of the same reason, most of existing anomaly detection techniques are based solely on expert knowledge or intuition in a given operating environment, and the cost have to pay is allow the limits to exist in terms of expected false alarms. Our research objective is to develop and design effective and efficient models, methods and techniques for anomaly-based intrusion detection in hosts and networks with provision of adaptability, dependability, and scalability.