Finding the Vocabulary of Program Behavior Data for Anomaly Detection

Application-based anomaly detectors construct a baseline model of normal application behavior, and deviations from that behavior are interpreted as signs of a possible intrusion. But current anomaly detectors monitor application behavior at a high level of detail, and many irrelevant variations in that behavior can cause false alarms. This paper discusses the preprocessing of audit data ultimately used by application-based anomaly detection systems. The goal is to create a more abstract picture of program behavior, filtering out many irrelevant details. Our specific approach automatically identifies repeating sub-sequences of behavior events and sequences of events that always occur together. Although this preprocessing technique can be used with a wide variety of program-based anomaly detectors, we present empirical results showing how it improves the performance of the well-known stide anomaly detection