Evaluation of Modified Vector Space Representation Using ADFA-LD and ADFA-WD Datasets

• 作者: Bhavesh Borisaniya Dhiren Patel
• 来源期刊: 信息安全(英文)
• 学科: 工学
• 关键词: System Call Trace VECTOR SPACE Model MODIFIED VECTOR SPACE REPRESENTATION ADFA-LD ADFA-WD
• 年，卷（期）: 2015,（3）
• 页码范围: 250-264
• 页数: 15页
• 分类号: TP39

摘要

Predicting anomalous behaviour of a running process using system call trace is a common practice among security community and it is still an active research area. It is a typical pattern recognition problem and can be dealt with machine learning algorithms. Standard system call datasets were employed to train these algorithms. However, advancements in operating systems made these datasets outdated and un-relevant. Australian Defence Force Academy Linux Dataset (ADFA-LD) and Australian Defence Force Academy Windows Dataset (ADFA-WD) are new generation system calls datasets that contain labelled system call traces for modern exploits and attacks on various applications. In this paper, we evaluate performance of Modified Vector Space Representation technique on ADFA-LD and ADFA-WD datasets using various classification algorithms. Our experimental results show that our method performs well and it helps accurately distinguishing process behaviour through system calls.