![](/images/graphics-bg.png)
Evaluation of Deep Learning Methods Efficiency for Malicious and Benign System Calls Classification on the AWSCTD
Joint Authors
Čeponis, Dainius
Goranin, Nikolaj
Source
Security and Communication Networks
Issue
Vol. 2019, Issue 2019 (31 Dec. 2019), pp.1-12, 12 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2019-11-11
Country of Publication
Egypt
No. of Pages
12
Main Subjects
Information Technology and Computer Science
Abstract EN
The increasing amount of malware and cyberattacks on a host level increases the need for a reliable anomaly-based host IDS (HIDS) that would be able to deal with zero-day attacks and would ensure low false alarm rate (FAR), which is critical for the detection of such activity.
Deep learning methods such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) are considered to be highly suitable for solving data-driven security solutions.
Therefore, it is necessary to perform the comparative analysis of such methods in order to evaluate their efficiency in attack classification as well as their ability to distinguish malicious and benign activity.
In this article, we present the results achieved with the AWSCTD (attack-caused Windows OS system calls traces dataset), which can be considered as the most exhaustive set of host-level anomalies at the moment, including 112.56 million system calls from 12110 executable malware samples and 3145 benign software samples with 16.3 million system calls.
The best results were obtained with CNNs with up to 90.0% accuracy for family classification and 95.0% accuracy for malicious/benign determination.
RNNs demonstrated slightly inferior results.
Furthermore, CNN tuning via an increase in the number of layers should make them practically applicable for host-level anomaly detection.
American Psychological Association (APA)
Čeponis, Dainius& Goranin, Nikolaj. 2019. Evaluation of Deep Learning Methods Efficiency for Malicious and Benign System Calls Classification on the AWSCTD. Security and Communication Networks،Vol. 2019, no. 2019, pp.1-12.
https://search.emarefa.net/detail/BIM-1210303
Modern Language Association (MLA)
Čeponis, Dainius& Goranin, Nikolaj. Evaluation of Deep Learning Methods Efficiency for Malicious and Benign System Calls Classification on the AWSCTD. Security and Communication Networks No. 2019 (2019), pp.1-12.
https://search.emarefa.net/detail/BIM-1210303
American Medical Association (AMA)
Čeponis, Dainius& Goranin, Nikolaj. Evaluation of Deep Learning Methods Efficiency for Malicious and Benign System Calls Classification on the AWSCTD. Security and Communication Networks. 2019. Vol. 2019, no. 2019, pp.1-12.
https://search.emarefa.net/detail/BIM-1210303
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1210303