An anomaly intrusion detection method using average Hamming distance

Intrusion detection plays a significant role in protecting information security. The existing techniques were analyzed, and then an effective method - AHDAD (average Hamming distance-based anomaly intrusion detection) was proposed to learn patterns of Unix processes. Fixed-length sequences of system calls were extracted from traces of programs, and the AHD (average Hamming distance) was calculated to classify normal and abnormal behaviors. The method has some advantages, such as algorithm simplicity, low overhead of time, high accuracy and real-time detection. Experiments on send-mail traces demonstrate that the method can detect intrusive actions accurately.