document: Learning nonstationary models of normal network traffic for detecting novel attacks Traditional intrusion detection systems ( IDS ) detect attacks by comparing current behavior to signatures of known attacks . One main drawback is the inability of detecting new attacks which do not have known signatures . In this paper we propose a learning algorithm that constructs models of normal behavior from attack-free network traffic . Behavior that deviates from the learned normal model signals possible novel attacks . Our IDS is unique in two respects . First , it is nonstationary , modeling probabilities based on the time since the last event rather than on average rate . This prevents alarm floods . Second , the IDS learns protocol vocabularies ( at the data link through application layers ) in order to detect unknown attacks that attempt to exploit implementation errors in poorly tested features of the target software . On the 1999 DARPA IDS evaluation data set ( 9 ) , we detect 70 of 180 attacks ( with 100 false alarms ) , about evenly divided between user behavioral anomalies ( IP addresses and ports , as modeled by most other systems ) and protocol anomalies . Because our methods are unconventional there is a significant non-overlap of our IDS with the original DARPA participants , which implies that they could be combined to increase coverage .
doc_bio_tags: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O