Accurate Efficient Program Behavior-based Anomaly Detection Model
An accurate efficient program behavior-based anomaly detection model is proposed.For statically-linked program portion and function recursive,optimized call stack walk is adopted to gain call stack state information,code insertion and Null call squelching is used to deal with loop function.Dynamic notifying technique is used to deal with non-standard control transfer.Thereby,it can gain complete system call context information,which improve the model's precision.Formal description of the new model is given,its enforcement is detailed and its advantages are discussed.Performance evaluations on Linux programs show that the new model is efficient.