Process Monitoring on Sequences of System Call Vectors
summary
Records system calls from processes (demoed via ipython and recorder tools listed as Estrela distress Civic), converts short time slices into count vectors (system call vectors), and trains recurrent nets (LSTM) implemented in tender flow to classify processes. Result: long-running processes achieve about 95% accuracy with a near-diagonal confusion matrix; short processes drop toward ~80% and show off-diagonal confusions, often between client/server variants. Baselines (logistic/SVM) are mentioned as weaker; preprocessing choices (row duration, truncation) strongly affect performance.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:28Outline
- 1:08System Call
- 1:31System Call Sequence
- 1:56System Call Groups
- 2:25Record System Calls
- 5:24Representation
- 7:13Motivation
- 10:20LSPM
- 11:05Recording System Calls
- 11:38Loop Recording
- 12:10Loop Recording Disadvantage
- 12:41Architecture
- 14:47Confusion Matrix
- 16:58Confusion Matters
- 18:08Improvements
- 19:09Credits
related talks
47m Natural Language Processing & Anomaly detection in Sys call logs
27mLog messages processing using NLP tools
50mClosing the Machine Learning Loop using Python
26mMonitoring models in production
50mSensor and Process Fingerprinting in Industrial Control Systems
12mCascade models in computer vision to boost accuracy and performance
37mRecent Solutions Using Deep Learning Models/ The How and Why
46mKeynote Q&A – Verónica Valeros