一种基于系统调用序列的异常检测模型

An Anomaly Detection Model Based on System Call Sequences

在利用相对差异度和差异密度表征实时系统调用序列与正常序列偏差的基础上,提出了一种新的检测实时序列异常与否的方法。试验表明该方法简单易操作,并能保证较高的检测率。

This paper brings up a new kind of anomaly detection approach by the use of relative difference degree and difference density. Experiments prove the feasibility of this method.