عنوان انگلیسی مقاله:
Combining heterogeneous anomaly detectors for improved software security
ترجمه فارسی عنوان مقاله:
ترکیب اشکارسازهای انومالی ناهمگن برای بهبود امنیت نرم افزار
Sciencedirect - Elsevier - The Journal of Systems & Software, Corrected proof. doi:10.1016/j.jss.2017.02.050
Wael Khreich a,∗, Syed Shariyar Murtaza a, Abdelwahab Hamou-Lhadj a, Chamseddine Talhi b
Host-based Anomaly Detection Systems (ADSs) monitor for significant deviations from normal software
behavior. Several techniques have been investigated for detecting anomalies in system call sequences.
Among these, Sequence Time-Delay Embedding (STIDE), Hidden Markov Model (HMM), and One-Class
Support Vector Machine (OCSVM) have shown a high level of anomaly detection accuracy. Although ADSs
can detect novel attacks, they generate a large number of false alarms due to the difficulty in obtaining
complete descriptions of normal software behavior. This paper presents a multiple-detector ADS that ef
ficiently combines the decisions from heterogeneous detectors (e.g., STIDE, HMM, and OCSVM), using
Boolean combination in the Receiver Operating Characteristics (ROC) space, to reduce the false alarms.
Results on two modern and large system call datasets generated from Linux and Windows operating sys
tems show that the proposed ADS consistently outperforms an ADS based on a single best detector and
on an ensemble of homogeneous detectors. At an operating point of zero percent alarm rate, the pro
posed multiple-detector ADS increased the true positive rate by 500% on the Linux dataset and by 25%
on the Window dataset. Furthermore, the combinations of decisions from multiple heterogeneous detec
tors make the ADS more reliable and resilient against evasion and adversarial attacks.
eywords: Anomaly detection systems | Intrusion detection systems | Heterogeneous and reliable systems | Decision-level combination