System call anomaly detection with least entropy length based on process traces
Ying WU, Jianhui Jiang · Journal of Computer Applications · 2013
In system call trace of a process,there are two kinds of invariability,program behavior invariability and user behavior invariability,of which the former can be further subdivided into temporal order invariability and frequency invariability.The existing researches on system call based intrusion detection techniques focus on program behavior invariability only,ignoring user behavior invariability.Based on frequency invariability embedded in process traces,the existence and description of user behavior invariability were studied,on which the least entropy length was proposed to measure the invariability.The experiment on Sendmail datasets shows that,least entropy length excellently describes user behavior invariability and significantly improves the performance of system call anomaly detection with the help of program behavior invariability.