Program behavior model based on system call and time interval

The automaton of program behavior based on system call is often used to model program behavior. The automaton of program behavior based on system call and time interval is proposed, which overcomes one of drawbacks of traditional automaton of program behavior based on system call: inability to monitor the program behavior between adjacent system calls. The method of quantifying time intervals between adjacent system calls is presented. Through monitoring the deviation degree of time intervals between adjacent system calls, the model can decide whether to deviate from normal program behavior between adjacent system calls to some extent. The experimental results show that the automaton of program behavior based on system call and time interval can model program behavior more accurately and has better detection ability of program behavior than traditional models.