{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/sequence-covering-for-efficient-host-based","title":"Sequence Covering for Efficient Host-Based Intrusion Detection","arxiv_id":"1712.02084","date":"2018-08-24","proceeding":null,"authors":["Marteau Pierre-François  EXPRESSION"],"abstract":"This paper introduces a new similarity measure, the covering similarity, that\nwe formally define for evaluating the similarity between a symbolic sequence\nand a set of symbolic sequences. A pair-wise similarity can also be directly\nderived from the covering similarity to compare two symbolic sequences. An\nefficient implementation to compute the covering similarity is proposed that\nuses a suffix tree data-structure, but other implementations, based on suffix\narray for instance, are possible and possibly necessary for handling large\nscale problems. We have used this similarity to isolate attack sequences from\nnormal sequences in the scope of Host-based Intrusion Detection. We have\nassessed the covering similarity on two well-known benchmarks in the field. In\nview of the results reported on these two datasets for the state of the art\nmethods, and according to the comparative study we have carried out based on\nthree challenging similarity measures commonly used for string processing or in\nbioinformatics, we show that the covering similarity is particularly relevant\nto address the detection of anomalies in sequences of system calls","url_abs":"http://arxiv.org/abs/1712.02084v2","url_pdf":"http://arxiv.org/pdf/1712.02084v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"sequence-covering-for-efficient-host-based","repo_url":"https://github.com/pfmarteau/STree4CS","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":null}],"tasks":[{"task_slug":"intrusion-detection","task_name":"Intrusion Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}