IDS::Algorithm::Chi2ICD - learn or test the character distribution of a string, using the Chi2 of ICD developed by Kruegel and Vigna (See the SEE ALSO section for the reference).
A usage synopsis would go here. Since it is not here, read on.
The learning and testing are based on section 4.2 in kruegel2003anomaly.
Someday more will be here.
ASSUMPTION: characters are 0..255; need to change to allow unicode, etc
Copyright 2005-2007, Kenneth Ingham. All rights reserved.
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
Address bug reports and comments to: ids_test at i-pi.com. When sending bug reports, please provide the versions of IDS::Test.pm, IDS::Algorithm.pm, IDS::DataSource.pm, the version of Perl, and the name and version of the operating system you are using. Since Kenneth is a PhD student, the speed of the reponse depends on how the research is proceeding.
Please report them.
the IDS::Test manpage, the IDS::DataSource manpage, the IDS::Algorithm manpage
"Anomaly detection of web-based attacks" by Christopher Kruegel and Giovanni Vigna, published in Proceedings of the 10th ACM conference on Computer and communications security 2003, pages 251--261, http://doi.acm.org/10.1145/948109.948144.