Anomaly Detection of System Call Sequence Based on Dynamic Features and Relaxed-SVM
Anomaly Detection of System Call Sequence Based on Dynamic Features and Relaxed-SVM
复制标题
基于动态特征和Relaxed-SVM的系统调用序列异常检测
DOI：
10.1155/2022/6401316
复制
发表时间：
2022-02
影响因子：
--
通讯作者：
Wen Chen
中科院分区：
文献类型：
--
作者：
Xiaoyao Liao;Changzhi Wang;Wen Chen
进程的系统调用序列对于基于主机的异常检测非常重要。但是，正常进程和异常进程调用序列中同时出现的子序列会严重降低检测精度。此外，当子序列的正态/异常分布非常不平衡以及许多模糊样本时，检测可能会受到阻碍。本文将系统调用序列划分为固定长度的加权子序列。其次，构造每个系统调用序列的后缀树，从树的最长重复子串中自动提取变长子序列；每个系统调用序列中出现的定长子序列和变长子序列的频率构成其特征向量。最后，将向量输入到代价敏感的松弛支持向量机中，松弛支持向量机的无惩罚松弛在两个不同权重的类之间独立分割。在ADFA-LD和UNM两个公开数据集上的实验结果表明，该方法的AUC可达99%，虚警率仅为2.4%。
The system call sequences of processes are important for host-based anomaly detection. However, the detection accuracy can be seriously degenerated by the subsequences which simultaneously appeared in the call sequences of both normal and abnormal processes. Furthermore, the detection may be obstructed especially when the normal/abnormal distributions of subsequences are extremely imbalanced along with many ambiguous samples. In the paper, the system call sequences are divided into weighted subsequences with fixed-length. Secondly, a suffix tree of each system call sequence is constructed to automatically extract the variable-length subsequence from the longest repeated substring of the tree. The frequencies of the fixed-and variable-length subsequences that appeared in each system call sequence constitute its feature vector. Finally, vectors are input into a cost-sensitive and relaxed support vector machine, in which the penalty-free slack of the relaxed SVM is split independently between the two classes with different weights. The experimental results on two public datasets ADFA-LD and UNM showed that the AUC of the proposed method can reach 99%, while the false alarm rate is only 2.4%.
登录
查看更多内容
DOI：
10.1007/978-3-319-11698-3_44
发表时间：
2014-10
期刊：
--
影响因子：
--
作者：
Miao Xie;Jiankun Hu;Xinghuo Yu;Elizabeth Chang
通讯作者：
Miao Xie;Jiankun Hu;Xinghuo Yu;Elizabeth Chang
DOI：
10.1142/9789812778222_0004
发表时间：
2002-09
期刊：
--
影响因子：
--
作者：
M. Crochemore;W. Rytter
通讯作者：
M. Crochemore;W. Rytter
影响因子：
3.7
作者：
Ambusaidi, Mohammed A.;He, Xiangjian;Tan, Zhiyuan
通讯作者：
Tan, Zhiyuan
DOI：
10.1109/secpri.1999.766910
发表时间：
1999
期刊：
Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344)
影响因子：
--
作者：
C. Warrender;S. Forrest;Barak A. Pearlmutter
通讯作者：
C. Warrender;S. Forrest;Barak A. Pearlmutter
DOI：
10.1016/j.cose.2020.102084
发表时间：
2021
期刊：
Comput. Secur.
影响因子：
--
作者：
Basant Subba;Prakriti Gupta
通讯作者：
Basant Subba;Prakriti Gupta