Process monitoring on sequences of system call count vectors

We introduce a methodology for efficient monitoring of processes running on hosts in a corporate network. The methodology is based on collecting streams of system calls produced by all or selected processes on the hosts, and sending them over the network to a monitoring server, where machine learning algorithms are used to identify changes in process behavior due to malicious activity, hardware failures, or software errors. The methodology uses a sequence of system call count vectors as the data format which can handle large and varying volumes of data. Unlike previous approaches, the methodology introduced in this paper is suitable for distributed collection and processing of data in large corporate networks. We evaluate the methodology both in a laboratory setting on a real-life setup and provide statistics characterizing performance and accuracy of the methodology.

• Publication year

  2017

• Venue

  International Carnahan Conference on Security Technology

• Publication date

  2017-07-12

• Fields of study

  Mathematics, Computer Science

• Identifiers
  DOI 10.1109/CCST.2017.8167792arXiv 1707.03821
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems

  2016cited by this paper
• Docker

  2015cited by this paper
• System Call-Based Detection of Malicious Processes

  2015cited by this paper
• Going deeper with convolutions

  2014cited by this paper
• A close look on n-grams in intrusion detection: anomaly detection vs. classification

  2013cited by this paper
• Intrusion Detection using Continuous Time Bayesian Networks

  2010cited by this paper
• LIBLINEAR: A Library for Large Linear Classification

  2008cited by this paper
• Anomaly Detection Using System Call Sequence Sets

  2007cited by this paper
• Anomalous system call detection

  2006cited by this paper
• On the Learning of System Call Attributes for Host-based Anomaly Detection

  2006cited by this paper
• A comparison of system call feature representations for insider threat detection

  2005influential reference
• Gray-box extraction of execution graphs for anomaly detection

  2004cited by this paper
• Random Forests

  2001cited by this paper
• Detecting intrusions using system calls: alternative data models

  1999cited by this paper
• Long Short-Term Memory

  1997cited by this paper
• A sense of self for Unix processes

  1996influential reference
• Estimation of the probability of an event as a function of several independent variables.

  1967cited by this paper

• Termite Attacks: Gnawing on Logs to Extract Secret Information

  2025cites this paper
• TraceLens: Early Detection of Software Anomalies Using Critical Path Analysis

  2025cites this paper
• Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models

  2024cites this paper
• Accurate Path Prediction of Provenance Traces

  2024cites this paper
• SoK: Leveraging Transformers for Malware Analysis

  2024cites this paper
• Language Models for Novelty Detection in System Call Traces

  2023cites this paper
• Insider Threat Detection: Using Classification Models

  2023cites this paper
• Performance Anomaly Detection through Sequence Alignment of System-Level Traces

  2022cites this paper
• Malware System Calls Detection Using Hybrid System

  2021influential citation
• On Improving Deep Learning Trace Analysis with System Call Arguments

  2021influential citation
• Detection of ESD-Induced Soft Failures by Analyzing Linux Kernel Function Calls

  2020cites this paper
• Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution

  2020influential citation
• Container Anomaly Detection Using Neural Networks Analyzing System Calls

  2020cites this paper
• System performance anomaly detection using tracing data analysis

  2019cites this paper
• Rule-Based Security Monitoring of Containerized Environments

  2019cites this paper
• AppMine: Behavioral Analytics for Web Application Vulnerability Detection

  2019cites this paper
• Rule-based Security Monitoring of Containerized Workloads

  2019cites this paper
• Automatic Cause Detection of Performance Problems in Web Applications

  2019cites this paper
• ONE KERNEL TO RULE THEM ALL

  2018cites this paper
• DTraComp: Comparing distributed execution traces for understanding intermittent latency sources

  year unknowncites this paper