SA Hofmeyr, S Forrest… - Journal of Computer …, 1998 - asu.elsevierpure.com
A method is introduced for detecting intrusions at the level of privileged processes. Evidence
is given that short sequences of system calls executed by running processes are a good …