Behavioral Distance Measurement Using Hidden Markov Models

摘要: The behavioral distance between two processes is a measure of the deviation their behaviors. Behavioral has been proposed for detecting compromise process, by computing its from another process executed on same input. Provided that are diverse and so unlikely to fall prey attacks, an increase in might indicate one them. In this paper we propose new approach calculation using type Hidden Markov Model. We also empirically evaluate intrusion detection capability our proposal when used system-call behaviors web servers. Our experiments show it detects intrusions with substantially greater accuracy performance overhead comparable prior proposals.