Sistem Çağrı Dizileri Kullanarak Ana Bilgisayar Tabanlı Saldırı Tespit Sistemlerinin Geliştirilmesi

Abstract

Sistem çağrı dizilerine dayalı ana bilgisayar tabanlı saldırı tespit sistemleri, siber güvenlik alanında kritik bir araştırma konusu olmakla birlikte, bu dizilerin yüksek boyutluluğu ve sıralı yapısı, doğrudan işlenmelerini güçleştirmektedir. Bu çalışmada, sistem çağrı dizileri içeren UNM live LPR, MIT live LPR ve bu iki veri kümesinin birleşiminden oluşturulan UNM-MIT live LPR veri kümeleri üzerinde farklı ön işlem yöntemleri uygulanmaktadır. Bu ön işlem yöntemleri içerisinde, n-gram, çeşitli BoW ve özellik seçim yöntemleri yer almaktadır. Ön işlem sonucunda, her bir veri kümesinden türetilen BoW veri kümeleri elde edilmektedir. Daha sonra, seçilen özellikleri içeren BoW veri kümeleri kullanılarak, hem bireysel hem de yığınlama topluluğu tabanlı makine öğrenimi modelleri/HIDS’leri geliştirilmektedir. Deneyler, geliştirilen bazı modellerin/HIDS’lerin, %0 yanlış pozitif oranı ve %100 doğruluk oranı ile yüksek performans sergilediğini göstermektedir.

Keywords

• Saldırı Tespit Sistemi
• Ana Bilgisayar Tabanlı Saldırı Tespit Sistemi
• Bilgi Güvenliği
• Sistem Çağrı Dizileri
• Makine Öğrenimi

Developing Host-Based Intrusion Detection Systems Using System Call Sequences

Abstract

Host-based intrusion detection systems based on system call sequences represent a critical research area in cybersecurity. However, these sequences' high dimensionality and sequential nature make their direct processing challenging. In this study, various preprocessing methods are applied to the UNM live LPR, MIT live LPR, and the combined UNM-MIT live LPR datasets containing system call sequences. These preprocessing methods included n-gram, various BoW, and feature selection methods. As a result of preprocessing, BoW datasets are derived from each dataset. Subsequently, both individual and stacking ensemble-based machine learning models/HIDS are developed using the BoW datasets containing the selected features. Experimental results indicated that some of the developed models/HIDS achieved high performance, with a 0% false positive rate and 100% accuracy.

Keywords

• Intrusion Detection System
• Host-based Intrusion Detection System
• Information Security
• System Call Sequences
• Machine Learning

References

1. Liao, H.-J. Lin, C.-H. R. Y.-C. Lin, ve Tung, K.-Y. ‘Intrusion detection system: A comprehensive review’, J. Netw. Comput. Appl., vol. 36, no. 1, pp. 16–24, 2013.
2. [Martins, I. Resende, J. S. Sousa, P. R. Silva, S. Antunes, L. ve Gama, J. ‘Host-based IDS: A review ve open issues of an anomaly detection system in IoT’, Futur. Gener. Comput. Syst., vol. 133, pp. 95–113, 2022.
3. Thakkar A. ve Lohiya, R. ‘A survey on intrusion detection system: feature selection, model, performance measures, application perspective, challenges, ve future research directions’, Artif. Intell. Rev., vol. 55,
4. Satilmiş, H. Akleylek, S. ve Tok, Z. Y. ‘A systematic literature review on host-based intrusion detection systems’, Ieee Access, vol. 12, pp. 27237–27266, 2024.
5. Jose, S. Malathi, D. Reddy, B. ve Jayaseeli, D. ‘A survey on anomaly based host intrusion detection system’, in Journal of Physics: Conference Series, 2018, vol. 1000, p. 12049.
6. Shin Y. ve Kim, K. ‘Comparison of anomaly detection accuracy of host-based intrusion detection systems based on different machine learning algorithms’, Int. J. Adv. Comput. Sci. Appl., vol. 11, no. 2, 2020.
7. Liu, W. Ci, L. L. ve Liu, L. P. ‘A new method of fuzzy support vector machine algorithm for intrusion detection’, Appl. Sci., vol. 10, no. 3, 2020, doi: 10.3390/app10031065.
8. Mishra, P. Verma, I. ve Gupta, S. ‘KVMInspector: KVM Based introspection approach to detect malware in cloud environment’, J. Inf. Secur. Appl., vol. 51, p. 102460, 2020, doi: 10.1016/j.jisa.2020.102460.

9. Subba B. ve Gupta, P. ‘A tfidfvectorizer ve singular value decomposition based host intrusion detection system framework for detecting anomalous system processes’, Comput. & Secur., vol. 100, p. 102084, 2021.
10. Melvin, A. A. R. Kathrine, G. J. W. Pasupathi, S. Shanmuganathan, V. ve Naganathan, R. ‘An AI powered system call analysis with bag of word approaches for the detection of intrusions ve malware in Australian Defence Force Academy ve virtual machine monitor malware attack data set’, Expert Syst., p. e13029, 2022.
11. Melvin A. A. R. ve ark., ‘Dynamic malware attack dataset leveraging virtual machine monitor audit data for the detection of intrusions in cloud’, Trans. Emerg. Telecommun. Technol., vol. 33, no. 4, pp. 1–19, 2022, doi: 10.1002/ett.4287.
12. Mishra, P. Gupta, A. Aggarwal, P. ve Pilli, E. S. ‘vServiceInspector: Introspection-assisted evolutionary bag-of-ngram approach to detect malware in cloud servers’, Ad Hoc Networks, vol. 131, no. April 2021, p. 102836, 2022, doi: 10.1016/j.adhoc.2022.102836.
13. Shamim, N. Asim, M. Baker, T. ve Awad, A. I. ‘Efficient Approach for Anomaly Detection in IoT Using System Calls’, Sensors, vol. 23, no. 2, pp. 1–24, 2023, doi: 10.3390/s23020652.
14. Chaudhari, A. Gohil, B. ve Rao, U. P. ‘A novel hybrid framework for cloud intrusion detection system using system call sequence analysis’, Cluster Comput., vol. 27, no. 3, pp. 3753–3769, 2024.
15. Vyšniunas, T. Čeponis, D. Goranin, N. ve Čenys, A. ‘Risk-based system-call sequence grouping method for malware intrusion detection’, Electronics, vol. 13, no. 1, p. 206, 2024.
16. Kim, Y. Hong, S.-Y. Park, S. ve Kim, H. K. ‘Reinforcement Learning-based Generative Security Framework for Host Intrusion Detection’, IEEE Access, 2025.
17. Shamim, N. Asim, M. Ismail Awad, A. ve Khurram Khan, M. ‘Anomaly Detection in Internet of Things System Calls Using a Centroid-Based Vector-Space Model’, IEEE Internet Things J., vol. 12, no. 14, pp. 26868–26881, 2025, doi: 10.1109/JIOT.2025.3562675.
18. Satilmiş, H. Akleylek, S. ve Yüce Tok, Z. ‘Development of Various Stacking Ensemble-Based HIDS Using ADFA Datasets’, IEEE Open J. Commun. Soc., vol. 6, pp. 1170–1189, 2025, doi: 10.1109/OJCOMS.2025.3538101.
19. Hofmeyr, S. A. Forrest, S. ve Somayaji, A. ‘Intrusion detection using sequences of system calls’, J. Comput. Secur., vol. 6, no. 3, pp. 151–180, 1998, doi: 10.3233/JCS-980109.