A comparison of input representations in neural networks: a case study in intrusion detection

Recently intrusion detection techniques have shifted from user-based and connection-based to process-based approach. Forrest et al. (1996) presented one or the first papers analyzing sequences of system calls issued by a process for intrusion detection. Warrender et al. (1999) do a comparison of the accuracy and performance of different algorithms for the analysis of sequential calls. In this paper we present a comparison of two different encoding methods for three types of neural networks. We apply these classifiers to implement an anomaly detection module for UNIX processes.