Applying fuzzy neural network to intrusion detection based on sequences of system calls

Abstract

Short sequences of system calls have been proven to be a good signature description for anomalous intrusion detection. The signature provides clear separation between different kinds of programs. This paper extends these works by applying fuzzy neural network (FNN) to solve the sharp boundary problem and decide whether a sequence is "normal" or "abnormal". By using threat level of system calls to label the sequences the proposed FNN improves the accuracy of anomaly detection. © Springer-Verlag Berlin Heidelberg 2005.