Study on HMM Based Anomaly Intrusion Detection Using System Calls
Shang-zhe SHI, Mei-feng Sun · 2012
In order to improve the detection accuracy, we study on the HMM model based on system calls anomaly detection.We starting from the program semantics issued system call, analysis that the state hidden behind system calls is the program execution state.Then put forward that hidden state must greater than the number of unique system calls when training HMM.And observation probability can be as 01 vector form.HMM trained in our way is better than other models on detection accuracy.