Host based intrusion detection system using frequency analysis of n-gram terms

The Host Based Intrusion Detection System (HIDS) is to prevent the host system from being compromised by intruders. To prevent the execution of malicious codes on the host, HIDS monitors the system audit and event logs. But the design of HIDS is very challenging due to the presence of high false alarm rate. This paper mainly focuses on reducing the problem of false alarm rate, using semantic based system call patterns. Here, we make use of the semantic approach to apply on the underlying kernel level system calls which can help understand the anomaly behavior. The semantic tool used is the data dictionary. The data dictionary containing every possible combinations of sequence of system call names of particular phrase length was constructed. The features satisfying the semantic hypothesis are extracted and then normalized. The normalized values are then given as input to the decision engine. The decision engine used is the Extreme Learning Machine - a new type of neural network. Performance was evaluated using the modern ADFA-LD dataset.

Stealthy malware hides its presence from the users of a system by hooking the relevant libraries, drivers, system calls or manipulating the services commonly used to monitor system behaviour. Tampering the network sensors of host-based intrusion detection systems (HIDS) may impair their ability to detect malware and significantly hinders subsequent forensic investigations. Nevertheless, the mere attempt to hide the traffic indicates malicious intentions. In this paper we show how comparison of the data collected by multiple sensors at different levels of resilience may reveal these intentions. At the lowest level of resilience, information from untrusted sensors such as netstat and process lists are used. At the highest resilience level, we analyse mirrored traffic using a secured hardware device. This technique can be considered as fully trusted. The detection of a discrepancy between what is reported by these common tools and what is observed on a trusted system operating at a different level is a good way to force a dilemma on malware writers: either apply hiding techniques, with the risk that the discrepancy is detected, or keep the status of network connections untouched, with a greater ability for the administrator to recognize the presence and to understand the behaviour of malware. The proposed method was implemented on an evaluation testbed and is able to detect stealthy malware that hides its communication from the HIDS. The false positive rate is 0.01% of the total traffic analysed, and barring a few exceptions that can easily be white-listed, there are no legitimate processes which raise false alerts.

Intrusion Detection systems are used for detecting attacks on a system. The host-based intrusion detection system (HIDS) detect the ongoing attacks on a Host system. HIDS model is proposed using System Call Analysis consisting of two modules, an Anomaly Detection module and a Multi-HMM module for state prediction. Anomaly Detection module uses Long Short-term memory (LSTM) architecture, a special type of Recurrent Neural Network, for detection of anomalies in system call traces. It models the normal behaviour of the system using system call patterns which enables it to detect even ‘Zero-day’ attacks. The State prediction module is based on Multiple Hidden Markov Model (Multi-HMM), in which each HMM model a known attack. It takes a sequence of system calls as input and predicts next ‘N’ most probable system calls during the attack. After performing a number of experiments, results show that the model has high recognition rate and low false alarm rate.

In the field of host-based intrusion detection systems(HIDS), existing anomaly detection algorithms paid much attention to extracting system call features, such as N-gram, frequency-based and neural networks, whereas few literatures introduce effective methods of modeling system call sequences with semantic features. This paper proposes a new model to represent system call sequences with novel applications of embedding techniques. The method converts system calls into embedding vectors as inputs for anomaly detector, mainly includes two parts: 1) construct embedding vectors for all system calls; 2) model the sequences with system call embedding and weighting. This sequence representation model is intuitive and effective on ADFA-LD dataset. As is illustrated with our experiment, the FPR can be significantly reduced to 0.53%, while the TPR still reaches 91.7%, even by a simple 1-NN classifier.

Intrusion detection based on system calls and homogeneous Markov chains

Despite the benefits containerization brings, threats and risks of attacks against containerized technology have grown in equal proportion to its adoption. Intrusion Detection Systems (IDS) have been employed to secure cloud and container environments. However, the inherent characteristics of these environments have presented new challenges to ensuring an adequate level of security. In this paper, a framework is proposed for implementing a Host-based Intrusion Detection System (HIDS) by analyzing system calls with machine learning on a Kubernetes container orchestration cluster. The presented framework prevents the overhead of the cluster nodes from processing focused on intrusion detection through a distributed and scalable architecture. Alerts generated in the occurrence of detected anomalies can be used as a complementary source of information for decision making and action by the Security Operations Center (SOC) team to deal with an eventual security incident. The proposed architecture was implemented in the GNS3 software, emulating a corporate network environment to demonstrate the feasibility of implementing the framework in a real environment.

As an important active defense technique for computer networks, intrusion detection has received lots of attention in recent years. However, the performance of current intrusion detection systems (IDSs) is far from being satisfactory due to the increasing number of complex sequential attacks. Aiming at the above problem, in this paper, a novel kernel-based reinforcement learning method for sequential behavior modeling in host-based IDSs is proposed. Based on Markov process modeling of host-based intrusion detection using sequences of system calls, the performance optimization of IDSs is transformed to a sequential prediction problem using evaluative reward signals. By using the kernel-based learning prediction algorithm, i.e., the kernel least-squares temporal-difference (kernel LS-TD) algorithm, which implements LS-TD learning in a kernel-induced feature space, the nonlinear modeling and prediction problem for sequential behaviors in IDSs is efficiently solved. Experiments on system call data from the University of New Mexico illustrate that the proposed kernel-based RL approach can achieve better detection accuracy than previous sequential behavior modeling methods including Hidden Markov Models (HMMs) and linear TD algorithms.

Application features such as port numbers are used by network-based intrusion detection systems (NIDSs) to detect attacks coming from networks. System calls and the operating system related information are used by host-based intrusion detection systems (HIDSs) to detect intrusions towards a host. However, the relationship between hardware architecture events and denial-of-service (DoS) attacks has not been well revealed. When increasingly sophisticated intrusions emerge, some attacks are able to bypass both the application and the operating system level feature monitors. Therefore, a more effective solution is required to enhance existing HIDSs. In this paper, we identify the following hardware architecture features: instruction count, cache miss, bus traffic and integrate them into a novel HIDS framework based on a modern statistical gradient boosting trees model. Through the integration of application, operating system and architecture level features, our proposed HIDS demonstrates a significant improvement of the detection rate in terms of sophisticated DoS intrusions.

In this paper, we design a prototype with hybrid software-enabled detection engine on the basis of an evolving block-based neural network (BBNN), and integrate it with a Field Programmable Gate Arrays (FPGA) board to enable a real-time host-based intrusion detection system (IDS). The established prototype can feed sequence of system calls obtained from a server directly into the BBNN based IDS. The structure and weights of BBNN are evolved by Genetic Algorithms. Experimental performance comparisons have been conducted against four major Support Vector Machines (SVMs) by carrying out leave-one-out cross validation. The results show that the improved BBNN outperforms other algorithms with respect to the classification and detection performances. The false alarm rate is successfully reduced as low as 2.22% while the detection rate 100% is still maintained. The running times of the proposed hardware based IDS versus other software based systems are also discussed.

In Iris recognition, the identification and authentication of an individual is carried out by analysis of unique patterns of iris. This paper presents, extracting the unique features from the iris images. The feature extraction is done by using concept of energy compaction. Palacky University Database is used as a test bed for proposed iris recognition technique, which contains 384 iris images of 64 persons, with 3 images for left eye and 3 images for right eye of each person. For the proposed iris recognition technique, self mutated hybrid wavelet transform of Cosine-Walsh, Cosine-Kekre and Cosine-Sine are used to generate transformed iris images. Considering all the coefficients for 100% of energy, feature vector of transformed iris image is generated, thus the size of feature vector becomes extremely large. For proposed Iris recognition technique, 99%, 98%, 97% and 96% of partial energies are considered, thus the number of coefficients considered to generate the feature vector are very less and the size of feature vector reduces severely. Accuracy using partial energies is high as compared to 100% of energy. The self mutated hybrid wavelet transform gives improvement in Genuine Acceptance Rate (GAR) and faster recognition. The best result is obtained for Cosine-Walsh self mutated hybrid wavelet transform as compared to other combinations.

In this work, a Behaviour-based Intrusion Detection Model is suggested. The proposed model can be employed from a single host configuration to a distributed mixture of host-based and network-based Intrusion Detection Systems (IDSs). Unlike most state-of-the-art IDSs that rely on analysing lower-level, raw-data representations, our proposed architecture suggests to use higher-level notions -behaviours- instead; this way, the IDS is able to identify more sophisticated attacks. To assess our premise, a Behaviour-based IDS (BIDS) prototype has been designed and developed that scans file system data to identify attacks. BIDS achieves high detection rates with low corresponding false positive rates, superseding other state-of-the-art file system IDSs.

Computing environments on cellphones, especially smartphones, are becoming more open and general-purpose, thus they also become attractive targets of malware. Cellphone malware not only causes privacy leakage, extra charges, and depletion of battery power, but also generates malicious traffic and drains down mobile network and service capacity. In this work we devise a novel behavior-based malware detection system named pBMDS, which adopts a probabilistic approach through correlating user inputs with system calls to detect anomalous activities in cellphones. pBMDS observes unique behaviors of the mobile phone applications and the operating users on input and output constrained devices, and leverages a Hidden Markov Model (HMM) to learn application and user behaviors from two major aspects: process state transitions and user operational patterns. Built on these, pBDMS identifies behavioral differences between malware and human users. Through extensive experiments on major smartphone platforms, we show that pBMDS can be easily deployed to existing smartphone hardware and it achieves high detection accuracy and low false positive rates in protecting major applications in smartphones.

This paper presents, efficient transform based face recognition technique which considers full and partial feature vector of an image. 2D-DCT and Walsh transform is applied on the resized image of size 128x128, to obtain its feature vector. Partial feature vector is obtained by selecting 75% rows and columns of feature vector, 50% rows and columns of feature vector and so on. The smallest size of partial feature vector is selected as 4x4. Proposed technique is tested on two different databases. Georgia Tech Face Database contains JPEG color images and Indian Face Database contains Bitmap color images of varying size. Recognition rate is calculated for varying size of selected feature vector using DCT and Walsh transform and compared. Also computational complexity in terms of number of CPU units is compared in both the cases: with full feature vector and with partial feature vector. Results show that, Walsh transform gives better recognition rate than DCT and number of CPU units required using 2D- Walsh transform is almost 9 times less than that of required by using 2D-DCT. This is because the multiplications required in Walsh transform are zero.

The extensive spread of harmful content, including hate speech, harassment, violent and adult material across online platforms and media channels poses significant challenges and has raised considerable concern within various societal groups. Government bodies, educators, and parents frequently find themselves in disagreement with media providers over the best methods to regulate and restrict such content. Automated content moderation technologies have become critical tools in addressing these challenges, particularly through natural language processing (NLP) techniques that can automatically detect and filter sensitive textual content, such as offensive language, violence, and adult materials, enabling platforms to enforce moderation policies on a large scale. Despite their widespread use, current moderation technologies face challenges related to detection accuracy, often resulting in substantial false positives and false negatives. To enhance content moderation systems, more advanced algorithms capable of accurately interpreting textual context are necessary. In this study, we assess current large language model (LLM)-based moderation solutions, specifically OpenAI moderation model and Llama-Guard-3, examining their effectiveness in detecting sensitive content. Additionally, we investigate the capabilities of contemporary LLMs, including OpenAI generative pre-trained transformer (GPT), Google Gemini, Meta Llama, Anthropic Claude, and small language models (SLMs) such as Google Gemma, in recognizing inappropriate content from diverse media sources. We also studied the performance of these models under adversarial attacks such as input perturbation and prompt injection. Our evaluation and comparative analysis utilize various textual datasets, such as X (Twitter) posts, Amazon product reviews, and news articles. The findings indicate that LLM-based approaches significantly demonstrate high accuracy and low rates of false positives and negatives. They also indicate the robustness of the models under various adversarial attacks. These results underscore the considerable potential for integrating advanced LLMs into websites and social media platforms, thereby enhancing content regulation and moderation effectiveness.

Digital images can be easily manipulated due to availability of powerful image processing software. Passive authentication as a common challenge method of digital image authentication is extensively used to detect the copy-move forgery images. In this paper, a passive authentication scheme is proposed to authenticate copy-move forgery based on discrete cosine transform (DCT). At the feature extraction step, DCT is applied to image blocks and makes use of the means of DCT coefficients to represent image blocks. The size of feature vectors are optimized. At the matching step, a set number of packages is used to store the feature vectors. The similar blocks can be found by comparing the feature vectors that are contained in adjacent packages. The experimental results demonstrate that the proposed scheme can locate irregular and meaningful tampered regions and multiply duplicated regions. In addition, it can also locate the duplicated regions in digital images that are distorted by adding white Gaussian noise, Gaussian blurring and their mixed operations.