Structure Extraction and Anomaly Detection for Linux Process Behavior
Cai Lidong · Jisuanji gongcheng · 2006
This paper investigats the extraction and anomaly detection for structure of Linux process behavior.The relations between program structures and process traces are first discussed,leading to a new concept of “structure anomaly” of process behavior.Then,a Markov chain prediction model is used and a novel strategy of sub-section detection of process sequences is proposed,forming a comprehensive method of anomaly detection in both structure and statistics.Primary experiments results show that this method is feasible.Finally,both merits and demerits of this approach are briefly presented.