A modified process anomaly detection using Boolean function

This paper proposes a process anomaly detection method using Boolean function to discover whether a running process is compromised. This method combines the results of multiple detectors to avoid the single detector´s limitation of inadequate training and therefore poor generalization performance. It aims at higher true positive rate and lower false positive rate in the detection. Traditional hidden Markov model is used and improved to describe the process, so that we can tell what normality is and what anomaly is. A simplified Boolean function is utilized to improve the efficiency. Two algorithms are proposed to evaluate and improve the detector´s performance. And it turns out to be satisfying with high true positive rate and low false positive rate in the simulation.