Intrusion Detection using Text Processing Techniques with a Binary-Weighted Cosine Metric

This paper introduces a new similarity measure, termed Binary Weighted Cosine (BWC) metric, for anomaly-based intrusion detection schemes that rely on using sequences of system calls. The new similarity measure considers both the number of shared system calls between two processes as well as frequencies of those calls. The k nearest neighbor (kNN) classifier is used to categorize a process as either normal or abnormal. The proposed BWC metric enhances the capabilities of simple kNN classifier significantly -especially in the context of intrusion detection. The experimental results obtained from 1998 DARPA Data, are very promising and show that the proposed scheme results in a high detection rate and low false positive rate.