Host Based Intrusion Detection System with Combined CNN/RNN Model

Ashima Chawla; Brian Lee; Sheila Fallon; Paul Jacob

doi:10.1007/978-3-030-13453-2_12

Host Based Intrusion Detection System with Combined CNN/RNN Model

Ashima Chawla, Brian Lee, Sheila Fallon, Paul Jacob

Limerick Institute of Technology,

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

101 Citations (Scopus)

Abstract

Cyber security has become one of the most challenging aspects of modern world digital technology and it has become imperative to minimize and possibly avoid the impact of cybercrimes. Host based intrusion detection systems help to protect systems from various kinds of malicious cyber attacks. One approach is to determine normal behaviour of a system based on sequences of system calls made by processes in the system [1]. This paper describes a computational efficient anomaly based intrusion detection system based on Recurrent Neural Networks. Using Gated Recurrent Units rather than the normal LSTM networks it is possible to obtain a set of comparable results with reduced training times. The incorporation of stacked CNNs with GRUs leads to improved anomaly IDS. Intrusion Detection is based on determining the probability of a particular call sequence occurring from a language model trained on normal call sequences from the ADFA Data set of system call traces [2]. Sequences with a low probability of occurring are classified as an anomaly.

Original language	English
Title of host publication	ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings
Editors	Carlos Alzate, Anna Monreale
Publisher	Springer-Verlag GmbH and Co. KG
Pages	149-158
Number of pages	10
ISBN (Print)	9783030134525
DOIs	https://doi.org/10.1007/978-3-030-13453-2_12
Publication status	Published - 2019
Event	European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2018 - Dublin, Ireland Duration: 10 Sep 2018 → 14 Sep 2018

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11329 LNAI
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2018
Country/Territory	Ireland
City	Dublin
Period	10/09/18 → 14/09/18

Keywords

Convolutional Neural Network (CNN)
Gated Recurrent Unit (GRU)
Host based intrusion detection systems (HIDS)
Recurrent Neural Network (RNN)
System calls

Access to Document

10.1007/978-3-030-13453-2_12

Cite this

Chawla, A., Lee, B., Fallon, S., & Jacob, P. (2019). Host Based Intrusion Detection System with Combined CNN/RNN Model. In C. Alzate, & A. Monreale (Eds.), ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings (pp. 149-158). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11329 LNAI). Springer-Verlag GmbH and Co. KG. https://doi.org/10.1007/978-3-030-13453-2_12

Chawla, Ashima ; Lee, Brian ; Fallon, Sheila et al. / Host Based Intrusion Detection System with Combined CNN/RNN Model. ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings. editor / Carlos Alzate ; Anna Monreale. Springer-Verlag GmbH and Co. KG, 2019. pp. 149-158 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{62bd98d77911422caa71439d07d233ac,

title = "Host Based Intrusion Detection System with Combined CNN/RNN Model",

abstract = "Cyber security has become one of the most challenging aspects of modern world digital technology and it has become imperative to minimize and possibly avoid the impact of cybercrimes. Host based intrusion detection systems help to protect systems from various kinds of malicious cyber attacks. One approach is to determine normal behaviour of a system based on sequences of system calls made by processes in the system [1]. This paper describes a computational efficient anomaly based intrusion detection system based on Recurrent Neural Networks. Using Gated Recurrent Units rather than the normal LSTM networks it is possible to obtain a set of comparable results with reduced training times. The incorporation of stacked CNNs with GRUs leads to improved anomaly IDS. Intrusion Detection is based on determining the probability of a particular call sequence occurring from a language model trained on normal call sequences from the ADFA Data set of system call traces [2]. Sequences with a low probability of occurring are classified as an anomaly.",

keywords = "Convolutional Neural Network (CNN), Gated Recurrent Unit (GRU), Host based intrusion detection systems (HIDS), Recurrent Neural Network (RNN), System calls",

author = "Ashima Chawla and Brian Lee and Sheila Fallon and Paul Jacob",

note = "Publisher Copyright: {\textcopyright} 2019, Springer Nature Switzerland AG.; European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2018 ; Conference date: 10-09-2018 Through 14-09-2018",

year = "2019",

doi = "10.1007/978-3-030-13453-2_12",

language = "English",

isbn = "9783030134525",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer-Verlag GmbH and Co. KG",

pages = "149--158",

editor = "Carlos Alzate and Anna Monreale",

booktitle = "ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings",

address = "Germany",

}

Chawla, A, Lee, B , Fallon, S & Jacob, P 2019, Host Based Intrusion Detection System with Combined CNN/RNN Model. in C Alzate & A Monreale (eds), ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11329 LNAI, Springer-Verlag GmbH and Co. KG, pp. 149-158, European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2018, Dublin, Ireland, 10/09/18. https://doi.org/10.1007/978-3-030-13453-2_12

Host Based Intrusion Detection System with Combined CNN/RNN Model. / Chawla, Ashima; Lee, Brian ; Fallon, Sheila et al.
ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings. ed. / Carlos Alzate; Anna Monreale. Springer-Verlag GmbH and Co. KG, 2019. p. 149-158 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11329 LNAI).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Host Based Intrusion Detection System with Combined CNN/RNN Model

AU - Chawla, Ashima

AU - Lee, Brian

AU - Fallon, Sheila

AU - Jacob, Paul

PY - 2019

Y1 - 2019

N2 - Cyber security has become one of the most challenging aspects of modern world digital technology and it has become imperative to minimize and possibly avoid the impact of cybercrimes. Host based intrusion detection systems help to protect systems from various kinds of malicious cyber attacks. One approach is to determine normal behaviour of a system based on sequences of system calls made by processes in the system [1]. This paper describes a computational efficient anomaly based intrusion detection system based on Recurrent Neural Networks. Using Gated Recurrent Units rather than the normal LSTM networks it is possible to obtain a set of comparable results with reduced training times. The incorporation of stacked CNNs with GRUs leads to improved anomaly IDS. Intrusion Detection is based on determining the probability of a particular call sequence occurring from a language model trained on normal call sequences from the ADFA Data set of system call traces [2]. Sequences with a low probability of occurring are classified as an anomaly.

AB - Cyber security has become one of the most challenging aspects of modern world digital technology and it has become imperative to minimize and possibly avoid the impact of cybercrimes. Host based intrusion detection systems help to protect systems from various kinds of malicious cyber attacks. One approach is to determine normal behaviour of a system based on sequences of system calls made by processes in the system [1]. This paper describes a computational efficient anomaly based intrusion detection system based on Recurrent Neural Networks. Using Gated Recurrent Units rather than the normal LSTM networks it is possible to obtain a set of comparable results with reduced training times. The incorporation of stacked CNNs with GRUs leads to improved anomaly IDS. Intrusion Detection is based on determining the probability of a particular call sequence occurring from a language model trained on normal call sequences from the ADFA Data set of system call traces [2]. Sequences with a low probability of occurring are classified as an anomaly.

KW - Convolutional Neural Network (CNN)

KW - Gated Recurrent Unit (GRU)

KW - Host based intrusion detection systems (HIDS)

KW - Recurrent Neural Network (RNN)

KW - System calls

UR - http://www.scopus.com/inward/record.url?scp=85063442018&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-13453-2_12

DO - 10.1007/978-3-030-13453-2_12

M3 - Conference contribution

AN - SCOPUS:85063442018

SN - 9783030134525

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 149

EP - 158

BT - ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings

A2 - Alzate, Carlos

A2 - Monreale, Anna

PB - Springer-Verlag GmbH and Co. KG

T2 - European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2018

Y2 - 10 September 2018 through 14 September 2018

ER -

Chawla A, Lee B , Fallon S , Jacob P. Host Based Intrusion Detection System with Combined CNN/RNN Model. In Alzate C, Monreale A, editors, ECML PKDD 2018 Workshops - Nemesis 2018, UrbReas 2018, SoGood 2018, IWAISe 2018, and Green Data Mining 2018, Proceedings. Springer-Verlag GmbH and Co. KG. 2019. p. 149-158. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-13453-2_12

Host Based Intrusion Detection System with Combined CNN/RNN Model

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this