Enhanced host-based intrusion detection using system call traces
Other Title(s)
نظام كشف التسلل المحسن بتتبع آثار استدعاءات الوظائف الأساسية في نظام التشغيل
Joint Authors
Madkur, Muhammad Ashraf Ismail
Sayyid, Yaqub Sayyid Ikram
Source
Journal of King Abdulaziz University : Computing and Information Technology Sciences
Issue
Vol. 8, Issue 2 (31 Dec. 2019), pp.93-109, 17 p.
Publisher
King Abdul Aziz University Faculty of Computing and Information Technology
Publication Date
2019-12-31
Country of Publication
Saudi Arabia
No. of Pages
17
Main Subjects
Information Technology and Computer Science
Abstract EN
To detect zero-day attacks in modern systems, several host-based intrusion detection systems are proposed using the newly compiled ADFA-LD dataset.
These techniques use the system call traces of the dataset to detect anomalies, but generally they suffer either from high computational cost as in window-based techniques or low detection rate as in frequency-based techniques.
To enhance the accuracy and speed, we propose a host-based intrusion detection system based on distinct short sequences extraction from traces of system calls with a novel algorithm to detect anomalies.
To the best of our knowledge, the obtained results of the proposed system are superior to all up-to-date published systems in terms of computational cost and learning time.
The obtained detection rate is also much higher than almost all compared systems and is very close to the highest result.
In particular, the proposed system provides the best combination of high detection rate and very small learning time.
The developed prototype achieved 90.48% detection rate, 22.5% false alarm rate, and a learning time of about 30 seconds.
This provides high capability to detect zero-day attacks and also makes it flexible to cope with any environmental changes since it can learn quickly and incrementally without the need to rebuild the whole classifier from scratch.
American Psychological Association (APA)
Sayyid, Yaqub Sayyid Ikram& Madkur, Muhammad Ashraf Ismail. 2019. Enhanced host-based intrusion detection using system call traces. Journal of King Abdulaziz University : Computing and Information Technology Sciences،Vol. 8, no. 2, pp.93-109.
https://search.emarefa.net/detail/BIM-931501
Modern Language Association (MLA)
Sayyid, Yaqub Sayyid Ikram& Madkur, Muhammad Ashraf Ismail. Enhanced host-based intrusion detection using system call traces. Journal of King Abdulaziz University : Computing and Information Technology Sciences Vol. 8, no. 2 (2019), pp.93-109.
https://search.emarefa.net/detail/BIM-931501
American Medical Association (AMA)
Sayyid, Yaqub Sayyid Ikram& Madkur, Muhammad Ashraf Ismail. Enhanced host-based intrusion detection using system call traces. Journal of King Abdulaziz University : Computing and Information Technology Sciences. 2019. Vol. 8, no. 2, pp.93-109.
https://search.emarefa.net/detail/BIM-931501
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references : p. 105-107
Record ID
BIM-931501