A New Approach of Intrusion Detection with Command Sequence-To-Sequence Model

Abstract

AbstractTraditionally, researchers have focused on network level intrusion detection and program level intrusion detection to improve computer security. However, neither approach is foolproof. We argue that the internal and external security of a computer system are equally important. Typically, a successful attacker manifests in the form of the attacker becoming a user on the host either with elevated or normal user privileges. At this point, user-level intrusion detection attempts to deter and curtail an attacker even after the system has been compromised. In this work, we introduce a new approach of intrusion detection based on recurrent neural networks (RNNs) to solve the long sequential problem. We build a robust user command sequence-to-sequence model by semantic modeling command. Our model implements the prediction of user command sequence and the prophesying of user behaviors. The experimental results on data sets of Purdue University, SEA and self-collected data show that an accurate, effective and efficient detection can be achieved by using the proposed approach.KeywordsUser behaviorRecurrent neural networksAnomaly intrusion detectionAttacks and defenses