安全审计中频率敏感的异常检测算法

传统使用系统调用序列的异常检测算法主要关注切分的长度，忽略了各个系统调用序列的发生频率对整个检测结果的重要性。该文提出一种对序列发生频率敏感的基于支持向量描述异常检测算法，利用发生频率定义样本的重要性，使分类器更加倾向于这些重要的样本。采用国际标准数据集进行测试，讨论了核参数对分类结果的影响。实验结果表明，与传统检测模型相比，基于序列发生频率的检测模型具有较低的误警率。

Frequency-sensitive Abnormal Detection Algorithm in Security Audit System

Traditional algorithms using sequences of system calls often pay close attention to the length of the sequences while ignoring the importance of their occurring frequency. A new detection algorithm using sequences of system calls is put forward based on their occurring frequency, the classifier may pay more attention to the importance of different sequences which is defined by their occurring frequency. Experiments using IS data sets show that the new model has a low false positive rate compared with the traditional model. And hence, adjusting some parameters can make the false positive rate better.