Note that there may be multiple processes within a single file, and they may be interleaved. The mapping between system call numbers and actual system call names is given in a separate file. Since a variety of tracing packages and operating systems were used, the same mapping file is not used for all programs. The individual program pages indicate which mapping is appropriate. Each mapping file is just a list of system call names, where the line number for each name indicates the number used for that system call.
Line numbers begin at zero.
In the training phase, stide builds a database of all unique, contiguous system call sequences of a predetermined fixed length occuring in the traces. During testing, stide compares sequences in the new traces to those in the database, and reports an anomaly measure indicating how much the new traces differ from the normal training data. The link below will let you download the stide code and a postscript version of the user's manual.