# LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems

arXiv: https://arxiv.org/abs/1611.01726 · HTML: https://mlsanity.com/paper/1611.01726/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Nov 2016.

## Built on by (most cited first, 9 of 9)

- [LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model](https://mlsanity.com/paper/2111.09564/) (2021)
- [Transfer Learning in Pre-Trained Large Language Models for Malware Detection Based on System Calls](https://mlsanity.com/paper/2405.09318/) (2024)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [On Improving Deep Learning Trace Analysis with System Call Arguments](https://mlsanity.com/paper/2103.06915/) (2021)
- [Automatic Cause Detection of Performance Problems in Web Applications](https://mlsanity.com/paper/2103.04954/) (2021)
- [Novelty Detection in Sequential Data by Informed Clustering and Modeling](https://mlsanity.com/paper/2103.03943/) (2021)
- [Language Models for Novelty Detection in System Call Traces](https://mlsanity.com/paper/2309.02206/) (2023)
- [From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation](https://mlsanity.com/paper/2605.17960/) (2026)
- [On the Effectiveness of Kernel-Level Evidence for Agent Security](https://mlsanity.com/paper/2609.28915/) (2026)

## Abstract (arXiv)

In computer security, designing a robust intrusion detection system is one of the most fundamental and important problems. In this paper, we propose a system-call language-modeling approach for designing anomaly-based host intrusion detection systems. To remedy the issue of high false-alarm rates commonly arising in conventional methods, we employ a novel ensemble method that blends multiple thresholding classifiers into a single one, making it possible to accumulate 'highly normal' sequences. The proposed system-call language model has various advantages leveraged by the fact that it can learn the semantic meaning and interactions of each system call that existing methods cannot effectively consider. Through diverse experiments on public benchmark datasets, we demonstrate the validity and effectiveness of the proposed method. Moreover, we show that our model possesses high portability, which is one of the key aspects of realizing successful intrusion detection systems.