A Method of Compressing Repeated Segments in System Call Sequences Executed by the Process
Huang Mei · 2004
The intrusion detection methods based on process don't pay enough attention to short repeated sequences of system calls executed by running processes. This paper presents a method of compressing repeated segments in sys- tem call sequences run by the process. When collecting the system calls ,we mark the repeated sequences,which are treated as a whole to the process of pattern extraction. The data of experiment show that the length of the system call sequence is reduced after compressing the repeated sequences, to simplify the procedure of pattern study and detection and increase the efficiency.