LLE on System Calls for Host Based Intrusion Detection

In this paper we examine the manifold learning approach for anomaly detection of sequences of system calls. We note that dimensionality reduction is very crucial for intrusion detection particularly when the training data is segmented into high-dimensional subsequences. We demonstrate that by applying manifold learning technique we can achieve substantial improvement in detection accuracy reducing the false positives. We examine the applicability of manifold learning in two different approaches. In the first approach, we represent the system call data as vectors by capturing the term frequencies and in the second approach; we represent the data as a decision table. We demonstrate that in both modes of representation, manifold learning method gives better result for the benchmark data sets