Host-based anomaly detection using Eigentraces feature extraction and one-class classification on system call trace data
This paper proposes a methodology for host-based anomaly detection using a semi-supervised algorithm namely one-class classifier combined with a PCA-based feature extraction technique called Eigentraces on system call trace data. The one-class classification is based on generating a set of artificial data using a reference distribution and combining the target class probability function with artificial class density function to estimate the target class density function through the Bayes formulation. The benchmark dataset, ADFA-LD, is employed for the simulation study. ADFA-LD dataset contains thousands of system call traces collected during various normal and attack processes for the Linux operating system environment. In order to pre-process and to extract features, windowing on the system call trace data followed by the principal component analysis which is named as Eigentraces is implemented. The target class probability function is modeled separately by Radial Basis Function neural network and Random Forest machine learners for performance comparison purposes. The simulation study showed that the proposed intrusion detection system offers high performance for detecting anomalies and normal activities with respect to a set of well-accepted metrics including detection rate, accuracy, and missed and false alarm rates.
Code (0)
등록된 구현이 없습니다.
Tasks
Anomaly DetectionIntrusion DetectionOne-Class ClassificationOne-class classifierSimilar Papers 제목 키워드 기반
Feature Selection for Fault Detection and Prediction based on Event Log Analysis
Event logs are widely used for anomaly detection and prediction in complex systems. Existing log-based anomaly detection methods usually consist of four main steps: log collection, log parsing, feature extraction, and an…
Anomaly DetectionFault Detectionfeature selectionLog Parsing+1Topological Data Analysis for Anomaly Detection in Host-Based Logs
Topological Data Analysis (TDA) gives practioners the ability to analyse the global structure of cybersecurity data. We use TDA for anomaly detection in host-based logs collected with the open-source Logging Made Easy (L…
Anomaly DetectionTopological Data AnalysisA Novel Self-Supervised Learning-Based Anomaly Node Detection Method Based on an Autoencoder in Wireless Sensor Networks
Due to the issue that existing wireless sensor network (WSN)-based anomaly detection methods only consider and analyze temporal features, in this paper, a self-supervised learning-based anomaly node detection method base…
Anomaly DetectionGraph Neural NetworkSelf-Supervised LearningHR-Crime: Human-Related Anomaly Detection in Surveillance Videos
The automatic detection of anomalies captured by surveillance settings is essential for speeding the otherwise laborious approach. To date, UCF-Crime is the largest available dataset for automatic visual analysis of anom…
Anomaly DetectionAnomaly Detection In Surveillance VideosDFM: Differentiable Feature Matching for Anomaly Detection
Feature matching methods for unsupervised anomaly detection have demonstrated impressive performance. Existing methods primarily rely on self-supervised training and handcrafted matching schemes for task adaptation. …
Anomaly Detectioncontinual anomaly detectionUnsupervised Anomaly Detection