Source-linked AI summary
LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems
Gyuwan Kim, Hayoon Yi, Jangho Lee, Yunheung Paek, Sungroh Yoon
TL;DR
Host-based anomaly detection must distinguish malicious from benign system-call activity despite scarce or absent attack examples. This paper models system-call sequences with an LSTM language model and integrates threshold classifiers in a ReLU-based ensemble; the authors report strong benchmark performance and portability with lower training overhead.
Problem
Host-based anomaly detection must distinguish malicious from benign system-call activity, although malicious behaviors are hidden and may be absent from training data.
Source: §1 · p. 1, §2.2 · p. 4Method
The paper models system-call sequences with an LSTM language model and proposes a ReLU-based ensemble that integrates multiple thresholding classifiers to reduce false alarms.
Source: §1 · p. 2Results
Across diverse benchmarks, the authors report outstanding performance versus existing state-of-the-art methods and robustness and generality; they also report portability and smaller training overhead than alternatives.
Source: §4 · p. 10Takeaways & Limitations
The authors present portability as a practical advantage, citing compact parameter storage and efficient training and inference without databases or dictionaries for potentially exponential patterns.
Source: §4 · p. 10The language model assumes the host system generates a finite set of possible system calls.
Source: §2.1 · p. 3
Abstract
from arXiv · showhide
In computer security, designing a robust intrusion detection system is one of the most fundamental and important problems. In this paper, we propose a system-call language-modeling approach for designing anomaly-based host intrusion detection systems. To remedy the issue of high false-alarm rates commonly arising in conventional methods, we employ a novel ensemble method that blends multiple thresholding classifiers into a single one, making it possible to accumulate 'highly normal' sequences. The proposed system-call language model has various advantages leveraged by the fact that it can learn the semantic meaning and interactions of each system call that existing methods cannot effectively consider. Through diverse experiments on public benchmark datasets, we demonstrate the validity and effectiveness of the proposed method. Moreover, we show that our model possesses high portability, which is one of the key aspects of realizing successful intrusion detection systems.
1 INTRODUCTION
Intrusion detection is increasingly important as networked systems face malicious activity and logging data grows. The paper proposes an LSTM system-call language model and an ensemble of thresholding classifiers to address limited feature capture and high false-alarm rates in anomaly-based host detection.
1 INTRODUCTION
- Anomaly-based host intrusion detection can potentially identify unseen attacks, but establishing a robust normal-behavior baseline may produce high false-alarm rates.The paper classifies its method as anomaly-based and host-based.Source: §1 · p. 1
- System-call traces are widely used for host anomaly detection, but frequency- and window-based methods have limited ability to capture call-level and phrase-level features simultaneously.The paper notes that traces are easy to collect in large quantities in real time.Source: §1 · p. 2
- The proposed system-call language model treats calls as words and sequences as sentences, estimating their likelihood in context to detect anomalous sequences.This applies neural language modeling to host-based intrusion detection.Source: §1 · p. 2
- The paper proposes LSTM units for enhanced long-range dependence learning and describes the framework as the first end-to-end system-call language model for detecting anomalous patterns.The authors qualify the first-work claim with “to the best of our knowledge.”Source: §1 · p. 2
- A leaky ReLU-based ensemble blends multiple thresholding classifiers trained to detect different highly normal sequences, aiming to lower false-alarm rates.The ensemble is also described as applicable to front ends other than the proposed language model.Source: §1 · p. 2
2 PROPOSED METHOD
The method combines an LSTM system-call language model with a back-end ensemble of thresholding classifiers. It also uses LSTM sequence representations with k-nearest-neighbor and k-means baselines.
2 PROPOSED METHOD
- The proposed pipeline has a system-call language-modeling front end and an anomaly-prediction back end built from an ensemble of thresholding classifiers.The front end can be used in various settings.Source: §2 · p. 3
2.1 LANGUAGE MODELING OF SYSTEM CALLS
- An LSTM models next-call probabilities from preceding calls, and sequence likelihoods above an average negative log-likelihood threshold are classified as abnormal.The model is trained on normal sequences using BPTT and cross-entropy; LSTM memory is motivated by the need to learn long-term dependencies.Source: §2.1 · pp. 3–4
2.2 ENSEMBLE METHOD TO MINIMIZE FALSE ALARM RATES
- A strong-normal model is difficult to train when attacks are absent and normal-call patterns are diverse and dynamic.Offline normal data may be generated under fixed conditions and can have bias.Source: §2.2 · p. 4
- The ensemble combines thresholding classifiers to accumulate “highly normal” sequences and target lower false-alarm rates.Leaky ReLU preserves low f values below normal-training median biases; including poor classifiers can degrade performance.Source: §2.2 · p. 5
2.3 BASELINE CLASSIFIERS
- The baselines classify LSTM sequence representations with kNN minimum-covering radii or k-means nearest-center distances.The experiments use Euclidean distance and empirically chosen k; kNN cost grows with the normal training-set size, while k-means is equivalent to 1-nearest-neighbor on its centers.Source: §2.3 · pp. 5–6
3 EXPERIMENTAL RESULTS AND DISCUSSION
On ADFA-LD, the proposed ensemble outperformed averaging and voting, while evaluation on KDD98 and UNM also indicated portability. Learned call representations clustered calls with similar functions, though attack-sequence clusters were not observed.
3.1 DATASETS
- The evaluation focused mainly on ADFA-LD, while also including KDD98 and UNM datasets used in earlier intrusion-detection research.ADFA-LD was generated around 2012; KDD98 and UNM were released in 1998 and 2004, respectively.Source: §3.1 · p. 6, Table 1 · p. 6
3.2 PERFORMANCE EVALUATION
- Using Euclidean distance, the two baseline classifiers achieved similar performance; empirically, kNN performed best at k = 11 and kMC performed best at k = 1, while increasing k produced similar but poorer results.Source: §3.2 · p. 7
- The proposed ensemble achieved an AUC of 0.928, exceeding averaging (0.890) and voting (0.859); its curve lay above individual single curves, a property absent from the other ensemble methods.Source: §3.2 · p. 7
- The ensemble operates without learning its parameters, which the authors present as appealing when attack data are unavailable.The authors note that using partial attack data would violate the anomaly-detection assumption and leave the zero-day attack issue.Source: §3.2 · p. 7
- At 90% DR, the proposed method achieved 16% FAR, comparable to ELM’s about 13% and below STIDE’s 23% and HMM’s 42%.The paper describes its approach as end-to-end, unlike ELM, which relies on hand-crafted features.Source: §3.2 · p. 8
3.3 PORTABILITY EVALUATION
- KDD98 evaluation reached AUC 0.994 and 2.3% FAR at 100% DR; the same model on UNM reached AUC 0.969 and 5.5% FAR at 99.8% DR, close to UNM-specific training.The portability test used a model trained on KDD98 normal traces and evaluated it on UNM.Source: §3.3 · p. 8, Figure 4 · p. 8
3.4 VISUALIZATION OF LEARNED REPRESENTATIONS
- The learned embedding clustered calls with similar functions, including read-write, open-close, and several waiting-call groups.The authors also report clusters for related symbolic-link, stat, and pipe calls.Source: §3.4 · p. 9
- The authors could not observe clustering of attack sequences, citing lack of data and the difficulty of separating abnormal patterns using only normal training patterns.Source: §3.4 · p. 10
4 CONCLUSION
The paper concludes that system-call language modeling and a threshold-classifier ensemble are its two main IDS contributions, with reported robustness and generality across diverse benchmarks.
4 CONCLUSION
- The system-call language model captures each call’s semantic meaning and relations to other calls, while the ensemble focuses on lowering false-alarm rates.The authors report performance comparisons with existing methods and robustness and generality across diverse benchmarks.Source: §4 · p. 10
- The method is described as portable, compact, and light, with lower training overhead because it avoids databases or dictionaries of potentially exponential pattern sets.The authors also describe training and inference as efficient, citing sequential matrix multiplications.Source: §4 · p. 10
- Planned future work includes detecting elaborate contemporary attacks such as mimicry, building online models from distributed data, altering RNN and ensemble structures, and combining signature-based methods with feature engineering.Source: §4 · p. 10