Identification of programs based on the behavior
M. V. Baklanovsky, A. R. Khanov
Saint Petersburg State University, Saint-Petersburg, Petergof, Universitetskii pr., 28, 198504, Russia
The algorithm of pattern mining from sequences of system calls is described. Patterns are used for process identification or establishing the fact that some sequence of system calls was produced by the process which was used in pattern extraction. Existing algorithms are computationaly more complex or reveals high false positive runs in experiments in comparision with an automaton building algorithm. Our algorithm is less complex and more precise in comparision with the classical N-gram algorithm. Performance tests reveal that our kernel monitor does not significatly slow down the processing of the operating system. After 20 minutes of learning the algorithm is able to identify any thread of any process with 85% precision. Program identification based on behavior is used for anomaly detection of malicious activities in system.
behavior analysis, anomaly detection, pattern mining.
PDF file (350 kB)
M. V. Baklanovsky, A. R. Khanov, “Identification of programs based on the behavior”, Model. Anal. Inform. Sist., 21:6 (2014), 120–130
Citation in format AMSBIB
\by M.~V.~Baklanovsky, A.~R.~Khanov
\paper Identification of programs based on the behavior
\jour Model. Anal. Inform. Sist.
Citing articles on Google Scholar:
Related articles on Google Scholar:
|Number of views:|