Abstract: In order to solve the problem of extracting feature library and detecting anomaly system calls slowly in intrusion detection methods,this paper proposed a novel two phrase intrusion detection method．In the first phrase,we extracted subsequences from normal system calls and calculated the frequency of the subsequences,and transformed the frequency feature into the frequency feature vector including continue numeric number．In order to improve the accuracy and speed of detecting anomaly system calls,the paper adopted one-class classification support vector machine(SVM) to build the detecting model,which uses the feature vector library to build the model．Finally,we conducted extensive experiment to evaluate the performance of our proposed method．The results show that our proposed method is superior to the existing methods in many evaluation metrics.

Key words: System calls,Intrusion detection,Frequency feature vector,Support vector machine