ANALYZING SYSTEM CALL SEQUENCES WITH ADABOOST

摘要

Adaboost constructs a composite classifier by sequentially training a learning algorithm with different distribution probability of the training examples. We are using this boosting by re-sampling algorithm to classify anomaly sequences of system call traces of UNIX programs. The classifiers used are Multi-layer Feedforward network (trained with Backpropagation), Radial-Basis Functions (trained with a Linear Perceptron) and Self Organizing Maps & Learning Vector Quantization. The main goal of these experiments is to show the improvement of the Adaboost algorithm over the classification rate of the networks (known as WeakLearners). Although the WeakLearners described in this paper have a fairly high classification rate (above 80%), we will show that Adaboost is able to improve their performance by 15% or more using a small number of machines in a committee.