learning rules from system call arguments and sequences for anomaly 20 detection .
Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation