Intrusion Prediction and Detection with Deep Sequence Modeling

Sarraf, Gaurav; Swetha, M.

doi:10.1007/978-981-15-4825-3_2

Cited by 2 publications

(3 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ahmed et al [7] wrote a survey on network anomaly detection technology and data set problems. Sarraf and Swetha [8] make use of ADFA intrusion dataset to learn long-term sequences of system-call executed during an attack on a Linux based web server. e model can effectively predict and classify sequences of system-calls most likely to occur during a known or unknown (zero-day) attacks.…”

Section: Host-based Intrusion Detectionmentioning

confidence: 99%

“…Machine learning and data mining algorithms have been widely applied to intrusion detection. Researchers and engineers have made efforts to improve the algorithms in order to cope with increasingly sophisticated intrusion methods as well as massive amounts of data [7,8]. For these methods, both traditional machine learning methods and deep learning methods are inseparable from feature engineering [1], although most deep learning methods, such as CNN based methods, will provide automatic feature engineering [9].…”

Section: Introductionmentioning

confidence: 99%

“…In system call based intrusion detection systems, we are dealing with a large number of sequences consisting of system calls [6,8]. e tasks can be classified into misuse detection (with labels) and anomaly detection (without labels) depending on whether the type of attack is known or not [11].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Using Graph Representation in Host-Based Intrusion Detection

Liu

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Cybersecurity has become an important part of our daily lives. As an important part, there are many researches on intrusion detection based on host system call in recent years. Compared to sentences, a sequence of system calls has unique characteristics. It contains implicit pattern relationships that are less sensitive to the order of occurrence and that have less impact on the classification results when the frequency of system calls varies slightly. There are also various properties such as resource consumption, execution time, predefined rules, and empirical weights of system calls. Commonly used word embedding methods, such as Bow, TI-IDF, N-Gram, and Word2Vec, do not fully exploit such relationships in sequences as well as conveniently support attribute expansion. To solve these problems, we introduce Graph Representation based Intrusion Detection (GRID), an intrusion detection framework based on graph representation learning. It captures the potential relationships between system calls to learn better features, and it is applicable to a wide range of back-end classifiers. GRID utilizes a new sequence embedding method Graph Random State Embedding (GRSE) that uses graph structures to model a finite number of sequence items and represent the structural association relationships between them. A more efficient representation of sequence embeddings is generated by random walks, word embeddings, and graph pooling. Moreover, it can be easily extended to sequences with attributes. Our experimental results on the AFDA-LD dataset show that GRID has an average improvement of 2% using the GRSE embedding method comparing to others.

show abstract

Section: Host-based Intrusion Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%