ROUGH SET THEORY’S APPLICATION ON INTRUSION DETECTION BASED ON SYSTEM CALLS

The system call sequences have already become one of the important data sources in host-based intrusion detection system. There are some merits which are high in accuracy, low in false fault and good in stability and so on by using the system calls analysis to judge the intrusion. This paper puts forward a high-efficient and low-loading abnormal detecting method aiming at sequences. The method is based on rough set and capable of extracting detection rules with the minimum size to form a normal behavior model from the record of sequences generated during the normal execution of process. Compared with other methods, the merits of using the Rough set theory to create the normal model are as follows: it is simple to get the training data; the small rules set is suitable to real-time detection, and the process’ abnormal running state can be detected out effectively. Experiment results show that the efficiency of the method in this paper is obvious higher than other methods.