Anomaly Detection of Linux Process Behavior Using Markov Chains
Cai Lidong · Jisuanji gongcheng · 2005
A Linux process can be presented by a system call sequence, and Markov chains analysis can be used to predicate sequential data with acorrectness fairly sensitive to whether the evolution of the sequential data is in normal or not. This paper proposes to apply Markov chains analysis topattern extraction and anomaly detection of Linux system call sequences while taking account of the sequential relation of system calls in process.Experiments suggest that this gives a reasonable explanation to behavior patterns and produces good results.