The DOI matches its Crossref record; 2 of the 2 references it cites were found in a registry or an index.
Detecting intrusions using system calls: alternative data models
Abstract
Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. We study one such observable-sequences of system calls into the kernel of an operating system. Using system-call data sets generated by several different programs, we compare the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions. We compare the following methods: simple enumeration of observed sequences; comparison of relative frequencies of different sequences; a rule induction technique; and hidden Markov models (HMMs). We discuss the factors affecting the performance of each method and conclude that for this particular problem, weaker methods than HMMs are likely sufficient.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
A tutorial on hidden Markov models and selected applications in speech recognition
Rabiner, L. R. (1989) · Proceedings of the IEEE · doi:10.1109/5.18626 · Cited by 22,743
An introduction to hidden Markov models
Rabiner, L., & Juang, B. (1986) · IEEE ASSP Magazine · doi:10.1109/massp.1986.1165342 · Cited by 4,775
Cited by
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194
Mimicry attacks on host-based intrusion detection systems
Wagner, D., & Soto, P. (2002) · Proceedings of the 9th ACM conference on Computer and communications security · doi:10.1145/586110.586145 · Cited by 714
A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data
Eskin, E., Arnold, A., Prerau, M., Portnoy, L., & Stolfo, S. (2002) · Advances in Information Security · doi:10.1007/978-1-4615-0953-0_4 · Cited by 683
Artificial intelligence, cyber-threats and industry 4.0: challenges and opportunities
Bécue, A., Praça, I., & Gama, J. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-020-09942-2 · Cited by 368
Metadata
- Authors
- Warrender, C., Forrest, S., & Pearlmutter, B.
- Venue
- Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)
- Publisher
- IEEE Comput. Soc
- Published
- 2003-01-20
- Pages
- 133-145
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2129860818
- Cited by
- 1,106
- References
- 2
- FWCI
- 49.48
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Detecting intrusions using system calls: alternative data models. https://app.cochat.ai/papers/10.1109/secpri.1999.766910
- The paper
- Warrender, C., Forrest, S., & Pearlmutter, B. (2003). Detecting intrusions using system calls: alternative data models. Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344). https://doi.org/10.1109/secpri.1999.766910
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
