A Method for Program Behavior Modeling and Searching Based on Full 16-Ary Ordered Trees

LUO Yu-xia,LIU Jin-gang
DOI: https://doi.org/10.3969/j.issn.1007-130x.2007.06.002
2007-01-01
Abstract:Program behavior modeling and searching is the key issue of anomaly detection. A method is presented, in which the segment ID and the offset of the program counter (PC),when system calls are invoked,are used as events.The event sequence set is produced by sliding the window in orderly events, and a normal behavior model set is built by using full 16-ary ordered trees.A full 16-ary ordered tree is designed for improving the efficiency of storing and searching rule sets.The storage byte sequence in the full 16-ary ordered tree implies the relationship information between nodes. The time complexity of searching the rule set for a rule only relates to the depth of the tree, and if the depth of the tree is fixed, the time complexity is O(1). The definition of a full 16-ary ordered tree, its features,its creating and searching algorithms are presented.
What problem does this paper attempt to address?