Anomalous Detection Based on Adaboost-HMM

In order to solve high false positive rate problems of anomalous intrusion detection, a novel method of anomalous detection based on Adaboost-HMM is proposed. HMM model can be adapted for modeling system call sequences and their state behaviors, but it has higher classification accuracy to the samples belonging to this class, however the accuracy is comparative lower than the samples not included in this class. To enhance classification rate, Adaboosting is used to improve the train of HMM and reduce classification error rate of HMM. At the same time, an improved abnormality detection algorithm based on time of event is also provided. The experiment results indicate this method can increase detection performance and lower false positive rate