This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
2010 IEEE 16th Pacific Rim International Symposium on Dependable Computing
Sequential Frequency Vector Based System Call Anomaly Detection
Tokyo, Japan
December 13-December 15
ISBN: 978-0-7695-4289-8
Although either of temporal ordering and frequency distribution information embedded in process traces can profile normal process behaviors, but none of ever published schemes uses both of them to detect system call anomaly. This paper claims combining those two kinds of useful information can improve detection performance and firstly proposes sequential frequency vector (SFV) to exploit both temporal ordering and frequency information for system call anomaly detection. Extensive experiments on DARPA-1998 and UNM dataset have substantiated the claim. It is shown that SFV contains richer information and significantly outperforms other techniques in achieving lower false positive rates at 100% detection rate.
Index Terms:
intrusion detection, system call, sequential frequency vector, enumerating model, KNN scheme
Citation:
Ying Wu, Jianhui Jiang, Liangliang Kong, "Sequential Frequency Vector Based System Call Anomaly Detection," prdc, pp.215-222, 2010 IEEE 16th Pacific Rim International Symposium on Dependable Computing, 2010
Usage of this product signifies your acceptance of the Terms of Use.