Anomaly Detection of System Call Sequence Based on Dynamic Features and Relaxed-SVM

Figure 2

Constructing suffix tree.

(a)

(b)

(c)