Finding the vocabulary of program behavior data for anomaly detection

摘要: Application-based anomaly detectors construct a base-line model of normal application behavior, and deviations from that behavior are interpreted as signs possible intrusion. But current monitor at high level detail, many irrelevant variations in can cause false alarms. This paper discusses the preprocessing audit data ultimately used by application-based detection systems. The goal is to create more abstract picture program filtering out details. Our specific approach automatically identifies repeating sub-sequences events sequences always occur together. main benefit this technique be with wide variety program-based detectors, but we present empirical results showing how it improves performance well-known stide system.