Camouflage Attack Detection Based on KMOD Kernel Function
Zaiqiang Ku, Zhi‐Hua Hu · 2008
The feature of UNIX command sequences is analyzed, and the user profile and camouflage attack detection technology based on OCSVM is proposed. OCSVM is an algorithm to deal with single value classification, while string kernel is a function to handle sequenced data. According to the feature of command sequence, two new string kernel functions are put forward by improving the general function. Experiments show that the detection method using string kernel based on OCSVM can achieve much higher detection accuracy comparing to the present camouflage attack detection methods.