Skip to main content
Article thumbnail
Location of Repository

Detecting Motifs in System Call Sequences

By William Wilson, J Feyereisl and Uwe Aickelin


The search for patterns or motifs in data represents an area of key interest to many researchers. In this paper we present the Motif Tracking Algorithm, a novel immune inspired pattern identification tool that is able to identify unknown motifs which repeat within time series data. The power of the algorithm is derived from its use of a small number of parameters with minimal assumptions. The algorithm searches from a completely neutral perspective that is independent of the data being analysed and the underlying motifs. In this paper the motif tracking algorithm is applied to the search for patterns within sequences of low level system calls between the Linux kernel and the operating system’s user space. The MTA is able to compress data found in large system call data sets to a limited number of motifs which summarise that data. The motifs provide a resource from which a profile of executed processes can be built. The potential for these profiles and new implications for security research are highlighted. A higher level system call language for measuring similarity between patterns of such calls is also suggested

OAI identifier:
Provided by: Nottingham ePrints

Suggested articles


  1. (1997). A probabilistic approach to fast pattern matching in time series databases.
  2. (1999). Detecting intrusions using system calls: Alternative data models. In:
  3. (2003). Discover motifs in multi-dimensional time series using the principal component analysis and the mdl principle. 3rd international conference on machine learning and data mining in pattern recognition Leipzig,
  4. (1996). E.C.: A fast look up algorithm for detecting repetitive dna sequences. Pacific symposium on biocomputing,
  5. (2002). F.J.: Learning and optimization using the clonal selection principle.
  6. (1994). Fast subsequence matching in time series databases. doi
  7. (2002). Finding motifs in time series.
  8. (2004). Morpheus: motif oriented representations to purge hostile events from unlabeled sequences. In:
  9. (2007). Motif detection inspired by immune memory. In:
  10. (1999). On preventing intrusions by process behavior monitoring. In:
  11. (2001). Pattern discovery from stock market time series using self organizing maps. Workshop notes of KDD2001 workshop on temporal data mining.
  12. (2003). Probabilistic discovery of time series motifs. SIGKDD
  13. (1996). T.A.: A sense of self for UNIX processes. In:
  14. (2005). The application of antigenic search techniques to time series forecasting.
  15. (2005). Visualizing and discovering non trivial patterns in large time series databases.

To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.