Abstract:In a contemporary data center, Linux applications often generate a large quantity of real-time system call traces, which are not suitable for traditional host-based intrusion detection systems deployed on every single host. Training data mining models with system calls on a single host that has static computing and storage capacity is time-consuming, and intermediate datasets are not capable of being efficiently handled. It is cumbersome for the maintenance and updating of host-based intrusion detection systems (HIDS) installed on every physical or virtual host, and comprehensive system call analysis can hardly be performed to detect complex and distributed attacks among multiple hosts. Considering these limitations of current system-call-based HIDS, in this article, we provide a review of the development of system-call-based HIDS and future research trends. Algorithms and techniques relevant to system-call-based HIDS are investigated, including feature extraction methods and various data mining algorithms. The HIDS dataset issues are discussed, including currently available datasets with system calls and approaches for researchers to generate new datasets. The application of system-call-based HIDS on current embedded systems is studied, and related works are investigated. Finally, future research trends are forecast regarding three aspects, namely, the reduction of the false-positive rate, the improvement of detection efficiency, and the enhancement of collaborative security.

An Intrusion Detection Method Based On System Call Temporal Serial Analysis

An Intrusion Detection System Based On System Call

Study of Adaptive Intrusion Detection with Data Mining

Anomaly Intrusion Detection Based on System Call

Design and Implementation of Intrusion Detection System Based on System-Call

Intrusion Detection Based on System Calls and Call Stack Log

Intrusion Detection Based on the Short Sequence Model

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

Multi-agent based hybrid Intrusion detection system

Intrusion Detection And Simulation For High-Speed Networks

Research on Data Mining-based Intrusion Detection in Real-time Environment

Host-Based Intrusion Detection System with System Calls

Predicting the Intrusion Intentions by Observing System Call Sequences

Intrusion Detection Models Based on Data Mining

Intrusion Detection Method Based on Two-Layer HMM

Host-Based Intrusion Detection System with System Calls: Review and Future Trends.

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Research of Applying Time-Based Sequence Model to Intrusion Detection

Intrusion Detection Using Variable-length System Calls Patterns

An Intrusion Detection of Anomalous Based on HMM System Call Sequence