A Reinforcement Learning Approach for Host-Based Intrusion Detection Using Sequences of System Calls

Xu, Xin; Xie, Tao

doi:10.1007/11538059_103

Cited by 44 publications

(21 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In one of our previous works [11], a linear TD learning algorithm was applied to host-based intrusion detection using sequences of system calls and very promising results have been obtained. Nevertheless, the approximation ability of linear function approximators is limited and the performance of linear TD learning is greatly influenced by the selection of linear basis functions.…”

Section: Kernel-based Ls-td Learning For Intrusion Detectionmentioning

confidence: 79%

“…As discussed in previous works [7] [11][12], each trace is defined as the sequence of system calls issued by a single process from the beginning of its execution to the end. If m successive system calls (o t-m+1 , o t-m+2 ,…,o t ) are selected as a state at time step t, and a sliding window with length l is defined, the traces of system calls can be transformed to corresponding state transition sequences.…”

Section: A Markov Reward Model For Host-based Idssmentioning

confidence: 99%

“…In our previous work [11], by introducing the above Markov reward model to the IDS problem, the intrusion detection problem can be transformed to the learning prediction of state anomaly probabilities, which can be approximated by the accumulated rewards received after a state and computed by the state value functions defined as follows:…”

Section: Fig 1 a Markov Reward Model For Intrusion Detectionmentioning

confidence: 99%

“…The kernel-based reinforcement learning method for intrusion detection makes use of least-squares temporal difference (LS-TD) [9] prediction in a kernel-induced feature space to realize nonlinear sequential behavior modeling [10], which is an important extension of our previous work on linear TD learning prediction for intrusion detection [11]. Experimental results on system call data from University of New Mexico (UNM) demonstrate that the kernel LS-TD method can achieve better prediction accuracy than previous methods.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Kernel-Based Reinforcement Learning Approach to Dynamic Behavior Modeling of Intrusion Detection

Luo

2007

Advances in Neural Networks – ISNN 2007

Self Cite

View full text Add to dashboard Cite

Abstract.As an important active defense technique for computer networks, intrusion detection has received lots of attention in recent years. However, the performance of current intrusion detection systems (IDSs) is far from being satisfactory due to the increasing number of complex sequential attacks. Aiming at the above problem, in this paper, a novel kernel-based reinforcement learning method for sequential behavior modeling in host-based IDSs is proposed. Based on Markov process modeling of host-based intrusion detection using sequences of system calls, the performance optimization of IDSs is transformed to a sequential prediction problem using evaluative reward signals. By using the kernel-based learning prediction algorithm, i.e., the kernel least-squares temporal-difference (kernel LS-TD) algorithm, which implements LS-TD learning in a kernel-induced feature space, the nonlinear modeling and prediction problem for sequential behaviors in IDSs is efficiently solved. Experiments on system call data from the University of New Mexico illustrate that the proposed kernel-based RL approach can achieve better detection accuracy than previous sequential behavior modeling methods including Hidden Markov Models (HMMs) and linear TD algorithms.

show abstract

Section: Kernel-based Ls-td Learning For Intrusion Detectionmentioning

confidence: 79%

Section: A Markov Reward Model For Host-based Idssmentioning

confidence: 99%

Section: Fig 1 a Markov Reward Model For Intrusion Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Kernel-Based Reinforcement Learning Approach to Dynamic Behavior Modeling of Intrusion Detection

Luo

2007

Advances in Neural Networks – ISNN 2007

Self Cite

View full text Add to dashboard Cite

show abstract

“…Reinforcement learning techniques have also been used to develop adaptive intrusion detection methods [21] for computer (wired) networks. Complex intrusion behavior is represented as a series of patterns and the learning agent is trained on audit data to identify these patterns.…”

Section: Reinforcement Learningmentioning

confidence: 99%

Towards modeling the behavior of physical intruders in a region monitored by a wireless sensor network

Krishnamoorthy

Wright

2010

Proceedings of the 3rd ACM Workshop on Artificial Intelligence and Security

View full text Add to dashboard Cite

DRL at the Network Layer

2023

Deep Reinforcement Learning for Wireless Communications and Networking

View full text Add to dashboard Cite

A Reinforcement Learning Approach for Host-Based Intrusion Detection Using Sequences of System Calls

Cited by 44 publications

References 7 publications

A Kernel-Based Reinforcement Learning Approach to Dynamic Behavior Modeling of Intrusion Detection

A Kernel-Based Reinforcement Learning Approach to Dynamic Behavior Modeling of Intrusion Detection

Towards modeling the behavior of physical intruders in a region monitored by a wireless sensor network

DRL at the Network Layer

Contact Info

Product

Resources

About