.png){kind=icon}
返回
Stacking ensemble-based HIDS framework for detecting anomalous system processes in Windows based operating systems using multiple word embedding
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2022.102961.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Globally, more than 80% of end-user devices run on Microsoft's Windows-based operating systems. There-fore, majority of the cyber-attack payloads are crafted explicitly for exploiting various vulnerabilities that exist across different software modules of Windows-based operating systems. To address this security is-sue, a stacking ensemble-based HIDS framework for detecting anomalous system processes is proposed in this paper. The proposed HIDS framework analyzes the process files comprising sequence of dll in-struction calls made by various application and system processes to the Windows operating system's kernel for detecting anomalous processes. The framework initially transforms the system process files comprising sequence of dll invocations into their corresponding n-gram feature vectors. It then uses two different state-of-the-art word embedding techniques namely, Word2Vec and GloVe to learn the contex-tual inter-dependencies between n-gram terms of the feature vectors, and generate fixed length word embedding vectors for each n-gram terms. These learned numeric word embedding vectors along with the n-gram feature vectors corresponding to the system process files are then provided as input to train an ensemble-based classifier model comprising LSTM, Bi-LSTM, GRU and Bi-GRU based base-level classi-fiers, and a fully connected neural network based meta-level classifier for classification of system pro-cess files as either normal or anomalous. The proposed HIDS framework is capable of detecting wide range of Windows-based attacks with high accuracy and precision. Experimental results show that the proposed HIDS framework achieves high accuracy and precision of 91.00% and 93.30%, respectively on the benchmark binary class Australian Defense Force Academy Windows Dataset (ADFA-WD) dataset. It also achieves an accuracy and precision of 68.70% and 67.80%, respectively on the multi-class ADFA-WD dataset, which are significantly higher than other similar HIDS frameworks proposed in the literature.(c) 2022 Published by Elsevier Ltd.
Keyword:
Host based Intrusion Detection
System(HIDS)
Ensemble-based classifier
Word Embedding
Word2Vec & GloVe
ADFA-WD dataset
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Antifreeze glycoproteins from Polar fish. Effects of freezing conditions on cooperative function.
OAAI
OAAI分享收藏分享收藏A tfidfvectorizer and singular value decomposition based host intrusion detection system framework for detecting anomalous system processes.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏Host-based IDS: A review and open issues of an anomaly detection system in IoT基于主机的IDS: 物联网异常检测系统的回顾和开放问题
PREAI
分享收藏Deep Learning Approach for Intelligent Intrusion Detection System面向智能入侵检测系统的深度学习方法IEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏A statistical pattern based feature extraction method on system call traces for anomaly detection
PREAI
分享收藏
查看更多内容