An adaptive real-time intrusion detection system using sequences of system call
Kaining Lu, Zehua Chen, Zhigang Jin, Jichang Guo · 2004
Intrusion detection is the process of monitoring computer networks and systems for violations of security policy. IDS may be of the network (NIDS) or host (HIDS) type. Traditionally, NIDS is the only way of preventing intrusion before an intrusion occurs through analyzing data packages, but has higher false rates. Although with lower false rates, HIDS detects anomalous actions by auditing host system logs that means the intrusion has took place. In this paper, we present one collaborate IDS module to make a real-time detection and block intrusions before occurrences, based on HIDS using sequences of system call anomaly detection.