A question for user behavior profile based IDS

From: fengli (lfeng@sei.xjtu.edu.cn)
Date: 03/27/02


From: "fengli" <lfeng@sei.xjtu.edu.cn>
To: "Focus-Ids" <focus-ids@securityfocus.com>
Date: Wed, 27 Mar 2002 21:43:15 +0800



  Hi all !
   I am doing the research about HIDS .and I want to analyze the user's behavior to get the their normal profiles .If the intruders or masqueraders' behavior deviate from the normal profiles then we can capture it !
   my question is How can we get the deviation ? Many years ago Sri co. put forward the "chi-square" (statistics methods) to mesure it in the NIDES. Does it really work?
   and by the way whether the research of user behavior profile based IDS is promising or not? and can you give me the advice for the promising methods for it?
  Any discussion or advice is appreciated!
                                                                                                                                                                                                  stonefeng

   



Relevant Pages

  • Re: for beldin and pp
    ... one, a productive one, but he is a worm, a wiggling worm, and he has ... promising to be Chris rather than Beldin, ... I didn't promise to ignore fundamental flaws in "advice" OR accept ... mathematically flawed justification for play recomendations. ...
    (rec.gambling.poker)
  • Re: H1 B...to be or not to be
    ... promising H1B visa for such and such, which brings me round to why I ... correctly informed of the real situation. ... You were getting advice. ...
    (misc.immigration.usa)
  • Reply: A question for user behaviour profile based IDS
    ... : RE: A question for user behaviour profile based IDS ... We are measuring numbers, the numbers should be independent of each other (incoming traffic on one port is fairly independent of another port number within reason) and, if we get enough packets, close to a smooth distribution. ... and by the way whether the research of user behavior profile based IDS is promising or not? ... Any discussion or advice is appreciated! ...
    (Focus-IDS)
  • Re: how long do posts stay up for?
    ... > posted a query yesterday and I got some advice which looked promising, ... *Replace nospam with smirnov to reply by e-mail* ...
    (microsoft.public.windowsxp.general)
  • Re: YouTube: EMIs Simon Gibson on Remastering Furtwangler
    ... on Amazon aren't promising. ... One reviewer says the new Beethoven ... Your advice applies to all purchases of anything. ... Profound, isn't it? ...
    (rec.music.classical.recordings)