SCADS: A Scalable Approach Using Spark in Cloud for Host-based Intrusion Detection System with System Calls

Abstract

Following the current big data trend, the scale of real-time system call traces generated by Linux applications in a contemporary data center may increase excessively. Due to the deficiency of scalability, it is challenging for traditional host-based intrusion detection systems deployed on every single host to collect, maintain, and manipulate those large-scale accumulated system call traces. It is inflexible to build data mining models on one physical host that has static computing capability and limited storage capacity. To address this issue, we propose SCADS, a corresponding solution using Apache Spark in the Google cloud environment. A set of Spark algorithms are developed to achieve the computational scalability. The experiment results demonstrate that the efficiency of intrusion detection can be enhanced, which indicates that the proposed method can apply to the design of next-generation host-based intrusion detection systems with system calls.

Explainable Artificial Intelligence in CyberSecurity: A Survey

“…Keeping the focus on HIDS in [73], Gas-sais et al propose a framework for intrusion detection in IoT which combines user and kernel space using AI techniques to automatically get devices behavior, process the data into numeric arrays to train several machine learning algorithms, and raise alerts whenever an intrusion is found. In [74] and [75] the authors focus the attention on Cloud Environment by detecting Anomalies while [76] propose a Siamese-CNN to determine the attack type converting it to an image. Analyzing the Network-based approaches, in [77], the authors present a NIDS model that employs a non-symmetric deep AutoEncoder and a Random Forest classifier.…”

An intelligent multiclass deep classifier‐based intrusion detection system for cloud environment

“…16 DL has been popular among researchers in recent years because it allows them to investigate the computational process and mimic the natural functioning of the human brain. 17,18 This effective DL network model is highly contributed to detecting malicious behavior from the traffic itself. 19 The cloud environment acts as a great host to save the big data efficiently; in that case, many systems try to communicate frequently at regular intervals.…”