Anomaly detection of software program runtime behavior based on principle component analysis

This paper proposes a novel model that uses principal component analysis in anomaly detection of software program executions. Anomalous executions of programs can be detected by a predictive model which is constructed from the major principal components of the normal program executions. The distance of an anomalous execution from the normal executions is measured in the principal component space. The experiments with Siemens and SPEC2000 test suites demonstrate that the proposed method can detect normal and abnormal program behavior precisely and effectively.