Host intrusion detection using system call argument-based clustering combined with Bayesian classification

Intrusion Detection System Based on Integrated System Calls Graph and Neural Networks

“…Following the same idea, another paper combines support vector machine and another technique in a network intrusion detection system [49], [50]. In [51], a host detection system based on system calls combines clustering and Bayes techniques. Finally, in [52], a network IDS uses two parallel classifiers to detect and track ransomware.…”

Review on Intrusion Detection System Based on The Goal of The Detection System

“…Several IDS studies have depended on the BC for the classification of normal and abnormal activities across a network. A clustering-based 2-stage classifier [18] has been presented for the derivation of similar subsets of system calls and models arbitrarily. A combination of clustering with supervised learning ensures the isolation of abnormal network behaviors and introduce domain-level information through carefully selected metrics.…”

“…This showed the HMM with suitable training and parameter estimation as a powerful method for the development of IDS that can classify traffic as normal or intrusions in real-time. A two-stage clustering-based classifier has also been proposed [18] for the generation of similar subsets of system calls and arbitrarily long sequences such as Markov chains.…”

Network Based Intrusion Detection Using the UNSW-NB15 Dataset

“…To counter both internal and external intrusions, Intrusion Detection System (IDS) are deployed by network administrators to protect key network and enterprise services from both internal and external intrusion attempts. http://dx.doi.org/10.12785/ijcds/080505 https://journal.uob.edu.bh Two classes of IDSs have emerged, namely (i) those that operate on network traffic called Network Intrusion Detection Systems (NIDS) [4]; they are often collocated with Firewalls and use network traffic traces for detecting intrusions, and (ii) Host Intrusion Detection Systems (HIDS) [5,6]; this breed is deployed on each network host, and uses information other than network traffic to detect intrusions. Such information includes application activity, traces, system calls and their parameters.…”

“…[14][15][16][17] to learn the characteristics of both intrusive and normal traffic from the network traffic, then use the learned models to detect attacks/intrusions without signatures [18]. One has to note that anomaly-based techniques have abundantly been applied to HIDS too learning from activities taking place inside a host computer [5]. The learned characteristics can either be in the form of parameter to general models (such as Markov models), rules, graph weights etc.…”