Markov Chains, Classifiers, and Intrusion Detection

This paper presents a statistical anomaly detection al-
gorithm based on Markov chains. Our algorithm can be di-
rectly applied for intrusion detection by discovering anoma-
lous activities. Our framework for constructing anomaly
detectors is very general and can be used by other re-
searchers for constructing Markov-chain-based anomaly
detectors. We also present performance metrics for eval-
uating the effectiveness of anomaly detectors. Extensive ex-
perimental results clearly demonstrate the effectiveness of
our algorithm. We discuss several future directions for re-
search based on the framework presented in this paper.