text: This paper introduces a new similarity measure, the covering similarity, which we formally define for evaluating the similarity between a symbolic sequence and a set of symbolic sequences. A pairwise similarity can also be directly derived from the covering similarity to compare two symbolic sequences. An efficient implementation to compute the covering similarity is proposed which uses a suffix-tree data structure, but other implementations, based on suffix array for instance, are possible and are possibly necessary for handling very large-scale problems. We have used this similarity to isolate attack sequences from normal sequences in the scope of host-based intrusion detection. We have assessed the covering similarity on two well-known benchmarks in the field. In view of the results reported on these two datasets for the state-of-the-art methods, according to the comparative study, we have carried out based on three challenging similarity measures commonly used for string processing, or in bioinformatics, we show that the covering similarity is particularly relevant to address the detection of anomalies in sequences of system calls.
  @cite_40: A method is introduced for detecting intrusions at the level of privileged processes. Evidence is given that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two waysc Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case several types of intrusive behavior were studieds in the latter case, results were analyzed for false positives.
  @cite_47: An anomaly intrusion detection approach based on Hybrid MLP CNN (Multi-layer Perceptron Chaotic Neural Network) neural network is proposed in this paper. Most anomaly detection approaches using MLP can detecting novel real-time attacks, but still have high false alarm rates. Most attacks are composed of a series of anomaly events. These attacks are called timedelayed attacks, which current neural network IDSs (Intrusion Detection System) cannot identify efficiently. A hybrid MLP CNN neural network is constructed in order to improve the detection rate of time-delayed attacks. While obtaining a similarly detection rate of real-time attacks as the MLP does, the proposed approach can detect time-delayed attacks efficiently with chaotic neuron. This approach also exhibits a lower false alarm rate when detects novel attacks. The simulation tests are conducted using DARPA 1998 dataset. The experimental results are presented and compared in ROC curves, which can demonstrate that the proposed approach performs exceptionally in terms of both detection rate and false alarm rate.
  @cite_17: Kernel methods are widely used in statistical learning for many fields, such as protein classification and image processing. We recently extend kernel methods to intrusion detection domain by introducing a new family of kernels suitable for intrusion detection. These kernels, combined with an unsupervised learning method - one-class support vector machine, are used for anomaly detection. Our experiments show that the new anomaly detection methods are able to achieve better accuracy rates than the conventional anomaly detectors.
summary: @cite_40 are quite popular since a fixed size window enables a wide range of statistical, knowledge-based and machine learning techniques to be applied in a straightforward manner. A fixed-size window is first defined, and then it progressively slides along the tested sequence. Each window (basically a fixed-size subsequence) is in general represented by a feature vector. Then, models such as the one class Support Vector Machine @cite_17 , Multi Layer Perceptron and Convolutional Neural Networks @cite_47 are used to provide a score for deciding whether an anomaly is present or not.