Anomaly Detection of System Call Sequence Based on Dynamic Features and Relaxed-SVM

<table class="table-group" id="tab5"><tr><td><table class="table"><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr class="thead"><td class="align_left">Dataset</td><td class="align_center">Sequences type</td><td class="align_center">Average information gain</td></tr><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr><td class="align_left" rowspan="2">ADFA-LD</td><td class="align_center">Selected</td><td class="align_center">0.185</td></tr><tr><td class="align_center">Unselected</td><td class="align_center">0.014</td></tr><tr><td class="align_left" colspan="3"><hr/></td></tr><tr><td class="align_left" rowspan="2">UNM</td><td class="align_center">Selected</td><td class="align_center">0.025</td></tr><tr><td class="align_center">Unselected</td><td class="align_center">0.015 3</td></tr><tr class="table-tr"><td colspan="3"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>ADFA-LD and UNM dataset: the information gain results for fixed-length sequences.</div>

Security and Communication Networks

tab5

Table 5

Table 5: Anomaly Detection of System Call Sequence Based on Dynamic Features and Relaxed-SVM 