Host Anomaly Detection Framework Based on Multifaceted Information Fusion of Semantic Features for System Calls
Obfuscation attack can bypass the detection of host security protection mechanism on the premise of achieving the same attack effect by modifying the system call sequence generated by the process running.The existing system call-based host anoma-ly detection methods cannot effectively detect the modified system call sequence after obfuscation attacks.This paper proposes a host anomaly detection method based on the fusion of multiple semantic information of system call.This method starts with the multiple semantic information of the system call sequence,fully mining the deep semantic information of the system call sequence through the system call semantic information abstraction and the system call semantic feature extraction,and uses the multi-chan-nel TextCNN to realize the fusion of multiple information for anomaly detection.Semantic abstraction of system call can realize the mapping of specific system call to its type and shield the influence of specific system call change on detection effect by extrac-ting sequence abstract semantic information.The system call semantic feature extraction uses the attention mechanism to obtain the key semantic features that represent the sequence behavior pattern.Experimental results on ADFA-LD dataset show that the false alarm rate of this method for detecting general host anomaly is lower than 2.2％,and the F1 score reaches 0.980.The false alarm rate of detecting the confusion attack is lower than 2.8％,and the F1 score reaches 0.969.Is detection performance is bet-ter than that of other methods.
Host anomaly detectionSystem call semantic information fusionObfuscation attackDeep learningAttention mecha-nism
NETL
NSTL
万方数据
