We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
EWMA techniques for computer intrusion detection through anomalous changes in event intensity.
- Authors
Nong Ye; Borror, Connie; Yebin Zhang
- Abstract
Intrusion detection is used to monitor and capture intrusions into computer and network systems, which attempt to compromise the security of computer and network systems. To protect information systems from intrusions and thus assure the reliability and quality of service of information systems, it is highly desirable to develop techniques that detect intrusions into information systems. Many intrusions manifest in dramatic changes in the intensity of events occurring in information systems. Because of the ability of exponentially weighted moving average (EWMA) control charts to monitor the rate of occurrences of events based on the their intensity, we apply three EWMA statistics to detect anomalous changes in the events intensity for intrusion detections. They include the EWMA chart for autocorrelated data, the EWMA chart for uncorrelated data and the EWMA chart for monitoring the process standard deviation. The objectives of this paper are to provide design procedures for realizing these control charts and investigate their performance using different parameter settings based on one large dataset. The early detection capability of these EWMA techniques is also examined to provide the guidance about the design capacity of information systems. Copyright © 2002 John Wiley & Sons, Ltd.
- Subjects
COMPUTER security; SECURITY systems; DATA protection; COMPUTER network security; RELIABILITY in engineering
- Publication
Quality & Reliability Engineering International, 2002, Vol 18, Issue 6, p443
- ISSN
0748-8017
- Publication type
Article
- DOI
10.1002/qre.493