Application of Loop Reduction to Learning Program Behaviors for Anomaly Detection

Abstract: Evidence of some attacks can be man-ifested by abnormal sequences of system calls of programs. Most approaches that have been devel-oped so far mainly concentrate on some program-speci c behaviors and ignore some plain behav-iors of programs. According to the concept of lo-cality of reference, programs tend to spend most of their time on a few lines of code rather than other parts of the program. We use this nding to propose a method of loop reduction. A loop reduction algorithm, when applied to a series of system calls, eliminates redundant data. We did experiments for the comparison before and after loop reduction with the same detection approach. The preliminary results show that loop reduction improves the quality of training data by removing redundancy