Abstract
Although some text processing techniques can be employed to intrusion detection based on the characterization of the frequencies of the system calls executed by the privileged programs, and achieve satisfactory detection accuracy, high false alarms make it hardly practicable in real life. In this paper, we modi.ed the traditional weighting method