LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems

Abstract

In computer security, designing a robust intrusion detection system is one of the most fundamental and important problems. In this paper, we propose a system-call language-modeling approach for designing anomaly-based host intrusion detection systems. To remedy the issue of high false-alarm rates commonly arising in conventional methods, we employ a novel ensemble method that blends multiple thresholding classifiers into a single one, making it possible to accumulate 'highly normal' sequences. The proposed system-call language model has various advantages leveraged by the fact that it can learn the semantic meaning and interactions of each system call that existing methods cannot effectively consider. Through diverse experiments on public benchmark datasets, we demonstrate the validity and effectiveness of the proposed method. Moreover, we show that our model possesses high portability, which is one of the key aspects of realizing successful intrusion detection systems.

12 pages, 5 figures

References in corpus (4)

• Adam: A Method for Stochastic Optimization
• Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
• Recurrent Neural Network Regularization
• Exploring the Limits of Language Modeling

Cited by in corpus (13)

• Deep Learning for Anomaly Detection: A Survey
• Deep Reinforcement Learning for Cyber Security
• Network Traffic Anomaly Detection Using Recurrent Neural Networks
• Sequence Aggregation Rules for Anomaly Detection in Computer Network Traffic
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• A short review on Applications of Deep learning for Cyber security
• Comparison of System Call Representations for Intrusion Detection
• LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model
• HeNet: A Deep Learning Approach on Intel${}^{\circledR }$ Processor Trace for Effective Exploit Detection
• Artificial Neural Network for Cybersecurity: A Comprehensive Review
• Novelty Detection in Sequential Data by Informed Clustering and Modeling
• Ten AI Stepping Stones for Cybersecurity
• A Planning Approach to Monitoring Behavior of Computer Programs