Frequency Weighted Hamming Distance for System Call Anomaly Detection
Ying Wu, Jianhui Jiang · 2009
Distance metric is critical to the performance of intrusion detection systems. Frequency weighted Hamming distance (FWHD) fully exploits system call distribution information contained in normal traces, and possesses richer information compared to Hamming distance. Our experiments show that FWHD behaves better than Hamming distance when used for system call anomaly detection.