Machine Learning Methods leveraging ADFA-LD Dataset for Anomaly Detection in Linux Host Systems

Advancement in network technology and revolution in the global internet transformed the overall Information Technology (IT) infrastructure and its usage. In the era of the Internet of Things (IoT) and the Internet of Everything (IoE), most everyday gadgets and electronic devices are IT-enabled and can be connected over the internet. With the advancements in IT technologies, operating systems also evolved to leverage these advancements. Today's operating systems are more user-friendly and feature-rich to support current IT requirements and provide sophisticated functionalities. On the one hand, these features enabled operating systems accomplish all current requirements, but on the other hand, these modern operating systems increased their attack surface considerably. Intrusion detection systems play a significant role in providing security against the broad spectrum of attacks on host systems. Intrusion detection systems based on anomaly detection have become a prominent research area among diverse areas of cyber security. The traditional approaches for anomaly detection are inadequate to discover the operating system level anomalies. The advancement and research in Machine Learning (ML) based anomaly detection open new opportunities to tackle this challenge. The dataset plays a significant role in ML-based system efficacy. The Australian Defence Force Academy Linux Dataset (ADFA-LD) comprises thousands of normal and attack processes system call traces for the Linux platform. It is the benchmark dataset used for dynamic approach-based anomaly detection. This paper provided a comprehensive and structured study of various research works based on the ADFA-LD for host-based anomaly detection and presented a comparative analysis.