Discrete fuzzy transform applied to computer anomaly detection

Intrusion detection systems (IDS) are widely applied to computer networks and systems as an information security control. Most of the current IDS work by detecting patterns of behavior of previously known attacks (attack signature). One drawback of signature based IDS is that they are vulnerable to previously unknown attacks. As an alternative, anomaly based IDS use a model of what is considered a normal behavior of a computer system or network and then they could detect any attack, know or unknown. The main problem of this approach is to find an adequate model of normality. In this paper, we present a method to build a model of behavior of computer network and systems. In this model a set of fuzzy organizational states are deduced from time series of computer resources utilization applying the discrete fuzzy transform.