# Intrusion Prediction with System-call Sequence-to-Sequence Model

arXiv: https://arxiv.org/abs/1808.01717 · HTML: https://mlsanity.com/paper/1808.01717/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Aug 2018.

## Built on by (most cited first, 3 of 3)

- [On Improving Deep Learning Trace Analysis with System Call Arguments](https://mlsanity.com/paper/2103.06915/) (2021)
- [Smart Metering System Capable of Anomaly Detection by Bi-directional LSTM Autoencoder](https://mlsanity.com/paper/2112.03275/) (2021)
- [Language Models for Novelty Detection in System Call Traces](https://mlsanity.com/paper/2309.02206/) (2023)

## Abstract (arXiv)

The advanced development of the Internet facilitates efficient information exchange while also been exploited by adversaries. Intrusion detection system (IDS) as an important defense component of network security has always been widely studied in security research. However, research on intrusion prediction, which is more critical for network security, is received less attention. We argue that the advanced anticipation and timely impede of invasion is more vital than simple alarms in security defenses. General research methods regarding prediction are analyzing short term of system-calls to predict forthcoming abnormal behaviors. In this paper we take advantages of the remarkable performance of recurrent neural networks (RNNs) in dealing with long sequential problem, introducing the sequence-to-sequence model into our intrusion prediction work. By semantic modeling system-calls we build a robust system-call sequence-to-sequence prediction model. With taking the system-call traces invoked during the program running as known prerequisite, our model predicts sequence of system-calls that is most likely to be executed in a near future period of time that enabled the ability of monitoring system status and prophesying the intrusion behaviors. Our experiments show that the predict method proposed in this paper achieved well prediction performance on ADFALD intrusion detection test data set. Moreover, the predicted sequence, combined with the known invoked traces of system, significantly improves the performance of intrusion detection verified on various classifiers.