## 3 Approach
### Filtering Rules Mining
#### 3.3.2 Workflow of Rule Mining
** When the candidate template set is empty, a new active template is formed directly as the pattern based on the input token sequence. The form of active templates is a tree, where non-leaf nodes represent patterns matching all input token sequences belonging to that template, and leaf nodes represent individual original input token sequence records. For performance considerations, the degree and maximum height of the tree are set to specific values. If the candidate template set is not empty, for each non-leaf node in the candidate templates, alignment is performed with the input token sequence based on word-level Longest Common Subsequence (LCS). [23] For templates with the wildcard \(<\)*\(>\), they can match any number of tokens until the token after the wildcard matches the input token. However, this matching is not counted in the length of the LCS. After word alignment is complete, similarity is calculated between the corresponding differences, using the original content that was not masked. According to the analysis and comparison in [27; 28; 29; 30], the algorithm selects the Jaro similarity (3) as the method for calculating word-level similarity. The overall process involves finding similarities between the input token sequences and the non-leaf nodes in the candidate templates, which leads to hierarchical clustering. \[sim_{j}= \begin{cases}0,&\text{if }m=0\\ \frac{1}{3}(\frac{m}{|s_{1}|}+\frac{m}{|s_{2}|}+\frac{m-t}{m}),&\text{otherwise} \end{cases}  \tag{3}\]  
In the equations, \(|s_{i}|\) represents the length of string \(s_{i}\), \(m\) is the number of matching characters, and \(t\) is the number of transpositions. If two strings do not match at all, the Jaro similarity is 0, and if they are identical, the Jaro similarity is 1. Then, the similarity between the input and the sub-template is calculated as (4). \[Sim(D,Q)=\frac{Length(LCS(D,Q))+\sum_{j=0}^{|Diffs|}sim_{j}}{Length(Q)} \tag{4}\]  
\(D\) represents the sub-template, \(Q\) represents the input, \(Length(LCS(D,Q))\) is the length of the Longest Common Subsequence between the two, \(|Diffs|\) is the number of differences, and \(sim_{j}\) is the similarity between the aforementioned differences. The sub-template with the highest similarity is selected as the best-matching template. The specific operation of hierarchical clustering is illustrated in Figure 4. It involves further merging the input with the records under this sub-template (extracting the differing parts as variable identifiers). For different numbers and types of differences, variable identifiers are assigned as enumeration values (\(<\)E\(>\)), range values (\(<\)R\(>\)), or free variable values (\(<\)*\(>\)). If the merged pattern matches the template pattern, no update is made to the template tree. Otherwise, the update is made based on the node's depth and the number of child nodes [23]. **Sequence rule mining. ** To achieve system call rules mining at the sequence level, our work additionally implements rule mining based on system call type sequences. The system call type sequence filtering uses a similar concept to the rolling hash algorithm for fast matching. Rolling Hash is a hash function used to quickly calculate the hash value of consecutive substrings in a string. In this method, each system call type is mapped to an integer between 0 and 255, and then the Rabin-Karp algorithm is used to calculate the hash value corresponding to each event and its historical window sequence, to quickly determine whether this sequence is in the sequence filtering rules. Since a large length can cause the sequence vector space explosion, and a small length can result in a lack of sequence information for events, each rule in this method adopts a fixed-length type sequence of 16, based on the conclusion of the research [13] and our analysis of the length of real anomaly sequences. The sequence collecting process initially involves the simple collection of 16-g of system call types present in the training set.