Application of Sequence Embedding in Host-based Intrusion Detection System

In the field of host-based intrusion detection systems(HIDS), existing anomaly detection algorithms paid much attention to extracting system call features, such as N-gram, frequency-based and neural networks, whereas few literatures introduce effective methods of modeling system call sequences with semantic features. This paper proposes a new model to represent system call sequences with novel applications of embedding techniques. The method converts system calls into embedding vectors as inputs for anomaly detector, mainly includes two parts: 1) construct embedding vectors for all system calls; 2) model the sequences with system call embedding and weighting. This sequence representation model is intuitive and effective on ADFA-LD dataset. As is illustrated with our experiment, the FPR can be significantly reduced to 0.53%, while the TPR still reaches 91.7%, even by a simple 1-NN classifier.