A tfidfvectorizer and singular value decomposition based host intrusion detection system framework for detecting anomalous system processes

摘要

Host based intrusion detection systems (HIDSs) are indispensable tools for providing a comprehensive security solution. They are capable of detecting host specific attacks, which cannot be detected using network based intrusion detection systems (NIDSs). This paper proposes a novel tfidfvectorizer and truncated singular value decomposition (SVD) based host intrusion detection system (HIDS) framework for identification of anomalous system processes in real time. The proposed HIDS framework takes the system call trace files as its input and transforms them into n-gram feature vector representational models. The framework then uses a vectorization technique called the tfid/uectorizer to compute the tfidf values of the n-gram terms of the transformed feature vectors. Dimensionality reduction of the transformed n-gram feature vectors are then carried out using truncated SVD based on their tfidf values. The dimensionality reduced tfidfvectorized n-gram feature vectors are finally provided as inputs to various machine learning based classifier models to determine whether the corresponding system call trace files are normal or anomalous. Experimental results on the benchmark ADFA-LD and ADFA-WD datasets show that the proposed HIDS framework effectively detects anomalous system processes with high accuracy and low processing overhead. It is also shown to outperform other HIDS frameworks proposed in the literature.