Abstract:System call sequences are useful criteria to judge the behaviors of processes. How to generate an efficient matching algorithm and how to build up an implementable system are two of the most difficult problems. In this paper, we explore the possibility of extending consecutive system call to incorporate temporal signature to the Host-based Intrusion Detection System. In this model, we use the real-time detected system call sequences and their consecutive time interval as the data source, and use temporal signature to filter the real model. During the monitoring procedure, we use data mining methods to analyze the source dynamically and implement incremental learning mechanism. Through studying small size samples and incremental learning, the detecting ability of the system can be still good when the sample's size is small. This paper also introduces the key technologies to build such a system, and verifies this intrusion detection method in real time environment. Finally, this paper gives the experiments results to verify the availability and efficiency of our system.

Anomaly Intrusion Detection Based on System Call

An Intrusion Detection System Based On System Call

Anomaly detection based on grammar

Survey on HMM Based Anomaly Intrusion Detection Using System Calls

A New Study of the System Call Sequence Analysis Method

An Intrusion Detection Method Based On System Call Temporal Serial Analysis

Anomaly detection method based on HMMs using system call and call stack information

Anomaly Detection Based on System Call Classification

Design and Implementation of Intrusion Detection System Based on System-Call

System Calls Based Intrusion Detection:A Survey

Study on Abnormal Detection Based on System Call and Data Mining Technique

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

An Intrusion Detection of Anomalous Based on HMM System Call Sequence

Intrusion Detection Based on System Calls and Call Stack Log

A HOST ANOMALY DETECTION METHOD BASED ON LDA MODEL

A Novel Anomaly Detection Approach for Executable Program Security

Host-Based Intrusion Detection System with System Calls

An Anomaly Intrusion Detection Method Based on Shell Commands

Technique of Anomaly Intrusion Detection Based on Neural Network and System Calls