Detection of Programs Behaviors on Context Dependency

Abstract

Anomaly detection of privileged program behaviors is one of the most important means to ensure the system security. An alternative modeling method is proposed based on the BP neural network classifier, which builds upon the concept of the context dependency short sequences and the specially designed m-nearest algorithm. It is because that the neural network classifiers have the advantages of high generalization capability on unknown data, and the context dependency can more accurately determine the nature of local behaviors for the short sequences, behavior detection performance of program traces was evidently improved as compared with the previous modeling method.