Anomaly Detection Based on Multi-Attribute Decision

Detection of intrusion attacks is an important issue in network security, this paper introduces a new anomaly detection scheme based on multi-attribute decisional framework. the system calls are used to characterize the processpsilas behavior, The data classification is performed by k-nearest neighbors(kNN) method and support vector machines(SVM) model . the experiments with KDD cup 1999 data demonstrate that our proposed method achieves 97.26% in hit rate with the false alarm rate 6.03% and outperforms the RIPPER method, and the time complexity is linear with the size of dataset and the number of attributes. since there is no need to build a profile for each program and check every sequence during the new program execution, the amount of calculation involved is largely reduced.