Statistical process control for computer intrusion detection

This paper describes the architecture of a distributed, host-based Intrusion Detection System (IDS) that we have developed at the Information and Systems Assurance Laboratory (ISA), Arizona State University (hence, ISA-IDS). ISA-IDS is developed based on statistical process control (SPC). In ISA-IDS we employ two intrusion detection techniques. One is an anomaly detection technique called Chi-square. Another is a misuse detection technique called Clustering. Each technique determines an intrusion warning (IW) level for each audit event. The IW levels from different intrusion detection techniques are then combined using a fusion technique into a composite IW level, 0 for normal, 1 for intrusive, and any value in between to signify, the intrusiveness. We also present the intrusion detection performance of the Chi-square and Clustering techniques