A fast automaton-based method for detecting anomalous program behaviors

摘要: Anomaly detection on system call sequences has become perhaps the most successful approach for detecting novel intrusions. A natural way learning is to use a finite-state automaton (FSA). However previous research indicates that FSA-learning computationally expensive, it cannot be completely automated or space usage of FSA may excessive. We present new overcomes these difficulties. Our builds compact in fully automatic and efficient manner, without requiring access source code programs. The requirements low - order few kilobytes typical uses only constant time per during as well period. This factor leads overheads intrusion detection. Unlike many techniques, our FSA-technique can capture both short term long temporal relationships among calls, thus perform more accurate enables generalize predict future behaviors from past behaviors. As result, training periods needed based are shorter. Moreover false positives reduced increasing likelihood missing attacks. paper describes technique presents comprehensive experimental evaluation technique.