Research on an Abnormal Detect Model for System Call Sequence Using Maximum Entropy Principle
Chen Song-qiao · Journal of Chinese Computer Systems · 2008
Now most of the Abnormal Detect Methods based on System Call Sequence analysis can't evaluate the capability of features characterizing process's behavior in the process of system call sequence reduction and feature selection,which causes many missed warnings and performance problems.In this paper,we propose a new abnormal detect model using maximum entropy principle,which achieves feature selection using mutual information and Z-Test,feature evaluation and systematizer using maximum entropy model.,and an efficient searching and matching process by reforming the Bloom Filter algorithm.In this way,our model may improve the performance of the system abnormal detecting greatly.A contrast experiment has been testified that we can find out the abnormal attack behavior immediately on a higher precision level.