Fixed vs. Variable-Length Patterns for Detecting Suspicious Process Behavior

This paper addresses the problem of creating patterns to model the normal behavior of UNIX processes. The pattern model can be used for intrusion-detection purposes. First, we present methods to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Second, we propose various techniques to derive either fixed-length or variable-length patterns from the input data sets. We show the advantages and drawbacks of each technique, based on the results of the experiments we have run on our testbed.