Using extended information to refine program behavior profile

System call provides the interface between an application and operating system, which is wildly used to detect network intrusions. By the extraction of extended information from system call stack, a new audit event is constructed and is used to refine the program profile in this paper. We name it as l-call. Meanwhile a Chebyshev´s inequality based approach is also proposed to measure the anomaly degree which reflects the degree of deviation from the normal behavior due to the intrusions. Compared with system call, l-call has much more granularity to better describe the program behavior. Although the number of l-call is greater than that of system call which will inevitably lead to greater storage overhead, many experiments show that these costs are at an acceptable level, and l-call-based model has acquired more detection performance than system-call-based model.