Anomaly Detection Using Support Vector Machines

摘要

In anomaly detection, we record the sequences of system calls in normal usage, and detect deviations from them as anomalies. In this paper, one-class support vector machine(SVM) classifiers with string kernels are adopted as the anomaly detector. A sequential learning algorithm for the classifiers is described. Two kinds of kernels are tested with an SVM classifier on the UNM data sets. Results indicate that the string kernel is superior to the RBF kernel for sequence data.