LSTM-Based System-Call Language Modeling and Robust Ensemble Method for
  Designing Host-Based Intrusion Detection Systems
  In computer security, designing a robust intrusion detection system is one of
the most fundamental and important problems. In this paper, we propose a
system-call language-modeling approach for designing anomaly-based host
intrusion detection systems. To remedy the issue of high false-alarm rates
commonly arising in conventional methods, we employ a novel ensemble method
that blends multiple thresholding classifiers into a single one, making it
possible to accumulate 'highly normal' sequences. The proposed system-call
language model has various advantages leveraged by the fact that it can learn
the semantic meaning and interactions of each system call that existing methods
cannot effectively consider. Through diverse experiments on public benchmark
datasets, we demonstrate the validity and effectiveness of the proposed method.
Moreover, we show that our model possesses high portability, which is one of
the key aspects of realizing successful intrusion detection systems.
