Fixed vs. Variable-Length Patterns for Detecting Suspicious Process Behavior

This paper addresses the problem of creating patterns that can be used to model the normal behavior of a given process. These models can be used for intrusion detection purposes. In a previous work, we presented a novel method to generate input data sets that enable us to observe the normal behavior of a process in a secure environment. Using this method, we propose various techniques to generate either fixed-length or variable-length patterns. We show the advantages and drawbacks of each technique, based on the results of the experiments
we have run on our testbed.

reprinted in Journal of Computer Security, vol. 8, p. 159-68, 2000