{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,6]],"date-time":"2026-04-06T10:14:58Z","timestamp":1775470498977,"version":"3.50.1"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030200046","type":"print"},{"value":"9783030200053","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,4,28]],"date-time":"2019-04-28T00:00:00Z","timestamp":1556409600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020]]},"DOI":"10.1007\/978-3-030-20005-3_2","type":"book-chapter","created":{"date-parts":[[2019,4,27]],"date-time":"2019-04-27T09:04:21Z","timestamp":1556355861000},"page":"14-24","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Comparison of System Call Representations for Intrusion Detection"],"prefix":"10.1007","author":[{"given":"Sarah","family":"Wunderlich","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Markus","family":"Ring","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dieter","family":"Landes","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andreas","family":"Hotho","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,4,28]]},"reference":[{"issue":"4","key":"2_CR1","doi-asserted-by":"publisher","first-page":"807","DOI":"10.1109\/TC.2013.13","volume":"63","author":"G Creech","year":"2014","unstructured":"Creech, G., Hu, J.: A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns. IEEE Trans. Comput. 63(4), 807\u2013819 (2014)","journal-title":"IEEE Trans. Comput."},{"key":"2_CR2","unstructured":"Forrest, S., Hofmeyr, S.A., Somayaji, A., Longstaff, T.A.: A sense of self for unix processes. In: IEEE Symposium on Security and Privacy, pp. 120\u2013128. IEEE (1996)"},{"issue":"3","key":"2_CR3","doi-asserted-by":"publisher","first-page":"151","DOI":"10.3233\/JCS-980109","volume":"6","author":"SA Hofmeyr","year":"1998","unstructured":"Hofmeyr, S.A., Forrest, S., Somayaji, A.: Intrusion detection using sequences of system calls. J. Comput. Secur. 6(3), 151\u2013180 (1998)","journal-title":"J. Comput. Secur."},{"key":"2_CR4","unstructured":"Kim, G., Yi, H., Lee, J., Paek, Y., Yoon, S.: LSTM-based system-call language modeling and robust ensemble method for designing host-based intrusion detection systems. arXiv preprint \n                    arXiv:1611.01726\n                    \n                  , pp. 1\u201312 (2016)"},{"key":"2_CR5","doi-asserted-by":"crossref","unstructured":"Kolosnjaji, B., Zarras, A., Webster, G., Eckert, C.: Deep learning for classification of malware system call sequences. In: Australasian Joint Conference on Artificial Intelligence (AI), pp. 137\u2013149. Springer (2016)","DOI":"10.1007\/978-3-319-50127-7_11"},{"issue":"7\u20138","key":"2_CR6","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1016\/j.cose.2007.10.003","volume":"26","author":"A Sharma","year":"2007","unstructured":"Sharma, A., Pujari, A.K., Paliwal, K.K.: Intrusion detection using text processing techniques with a kernel based similarity measure. Comput. Secur. 26(7\u20138), 488\u2013495 (2007)","journal-title":"Comput. Secur."},{"key":"2_CR7","doi-asserted-by":"crossref","unstructured":"Murtaza, S.S., Khreich, W., Hamou-Lhadj, A., Gagnon, S.: A trace abstraction approach for host-based anomaly detection. In: IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), pp. 170\u2013177. IEEE (2015)","DOI":"10.1109\/CISDA.2015.7208644"},{"issue":"8","key":"2_CR8","doi-asserted-by":"publisher","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","volume":"9","author":"S Hochreiter","year":"1997","unstructured":"Hochreiter, S., Schmidhuber, J.: Long short-term memory. Neural Comput. 9(8), 1735\u20131780 (1997)","journal-title":"Neural Comput."},{"key":"2_CR9","doi-asserted-by":"crossref","unstructured":"Creech, G., Hu, J.: Generation of a new IDS test dataset: time to retire the KDD collection. In: IEEE Wireless Communications and Networking Conference (WCNC), pp. 4487\u20134492. IEEE (2013)","DOI":"10.1109\/WCNC.2013.6555301"},{"key":"2_CR10","unstructured":"Eskin, E., Lee, W., Stolfo, S.J.: Modeling system calls for intrusion detection with dynamic window sizes. In: DARPA Information Survivability Conference & Exposition II (DISCEX), vol.\u00a01, pp. 165\u2013175. IEEE (2001)"},{"key":"2_CR11","unstructured":"Hoang, X.D., Hu, J.: An efficient hidden markov model training scheme for anomaly intrusion detection of server applications based on system calls. In: IEEE International Conference on Networks (ICon), vol.\u00a02, pp. 470\u2013474. IEEE (2004)"},{"issue":"5","key":"2_CR12","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1109\/52.605929","volume":"14","author":"AP Kosoresow","year":"1997","unstructured":"Kosoresow, A.P., Hofmeyer, S.: Intrusion detection via system call traces. IEEE Softw. 14(5), 35\u201342 (1997)","journal-title":"IEEE Softw."},{"key":"2_CR13","first-page":"77","volume":"6","author":"E Eskin","year":"2002","unstructured":"Eskin, E., Arnold, A., Prerau, M., Portnoy, L., Stolfo, S.: A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data. Appl. Data Min. Comput. Secur. 6, 77\u2013102 (2002)","journal-title":"Appl. Data Min. Comput. Secur."},{"key":"2_CR14","unstructured":"Wang, Y., Wong, J., Miner, A.: Anomaly intrusion detection using one class SVM. In: IEEE SMC Information Assurance Workshop, pp. 358\u2013364. IEEE (2004)"},{"key":"2_CR15","unstructured":"Chawla, A., Lee, B., Fallon, S., Jacob, P.: Host based intrusion detection system with combined CNN\/RNN model. In: International Workshop on AI in Security, pp. 9\u201318 (2018)"},{"key":"2_CR16","doi-asserted-by":"crossref","unstructured":"Xie, M., Hu, J., Yu, X., Chang, E.: Evaluating host-based anomaly detection systems: application of the frequency-based algorithms to ADFA-LD. In: International Conference on Network and System Security, pp. 542\u2013549. Springer (2014)","DOI":"10.1007\/978-3-319-11698-3_44"},{"key":"2_CR17","unstructured":"Mikolov, T., Sutskever, I., Chen, K., Corrado, G.S., Dean, J.: Distributed representations of words and phrases and their compositionality. In: Advances in Neural Information Processing Systems, pp. 3111\u20133119 (2013)"},{"key":"2_CR18","doi-asserted-by":"crossref","unstructured":"Pennington, J., Socher, R., Manning, C.: GloVe: global vectors for word representation. In: Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 1532\u20131543 (2014)","DOI":"10.3115\/v1\/D14-1162"},{"key":"2_CR19","doi-asserted-by":"crossref","unstructured":"Ring, M., Landes, D., Dallmann, A., Hotho, A.: IP2Vec: learning similarities between IP adresses. In: Workshop on Data Mining for Cyber Security (DMCS), International Conference on Data Mining Workshops (ICDMW), pp. 657\u2013666. IEEE (2017)","DOI":"10.1109\/ICDMW.2017.93"},{"key":"2_CR20","unstructured":"[Online] DARPA 1998\/1999\u00a0Dataset. \n                    https:\/\/www.ll.mit.edu\/r-d\/datasets\n                    \n                  . Accessed 14 Mar 2019"},{"key":"2_CR21","unstructured":"[Online] UNM\u00a0Dataset. \n                    https:\/\/www.cs.unm.edu\/~immsec\/systemcalls.htm\n                    \n                  . Accessed 14 Nov 2018"},{"key":"2_CR22","unstructured":"Warrender, C., Forrest, S., Pearlmutter, B.: Detecting intrusions using system calls: alternative data models. In: IEEE Symposium on Security and Privacy, pp. 133\u2013145. IEEE (1999)"},{"issue":"4","key":"2_CR23","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J McHugh","year":"2000","unstructured":"McHugh, J.: Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln laboratory. ACM Trans. Inform. Syst. Secur. (TISSEC) 3(4), 262\u2013294 (2000)","journal-title":"ACM Trans. Inform. Syst. Secur. (TISSEC)"},{"issue":"9","key":"2_CR24","doi-asserted-by":"publisher","first-page":"1263","DOI":"10.1109\/TKDE.2008.239","volume":"21","author":"H He","year":"2009","unstructured":"He, H., Garcia, E.A.: Learning from imbalanced data. IEEE Trans. Knowl. Data Eng. 21(9), 1263\u20131284 (2009)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"1","key":"2_CR25","first-page":"1929","volume":"15","author":"N Srivastava","year":"2014","unstructured":"Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., Salakhutdinov, R.: Dropout: a simple way to prevent neural networks from overfitting. J. Mach. Learn. Res. 15(1), 1929\u20131958 (2014)","journal-title":"J. Mach. Learn. Res."},{"key":"2_CR26","first-page":"115","volume":"3","author":"FA Gers","year":"2002","unstructured":"Gers, F.A., Schraudolph, N.N., Schmidhuber, J.: Learning precise timing with LSTM recurrent networks. J. Mach. Learn. Res. 3, 115\u2013143 (2002)","journal-title":"J. Mach. Learn. Res."}],"container-title":["Advances in Intelligent Systems and Computing","International Joint Conference: 12th International Conference on Computational Intelligence in Security for Information Systems (CISIS 2019) and 10th International Conference on EUropean Transnational Education (ICEUTE 2019)"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-20005-3_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,18]],"date-time":"2019-05-18T04:08:52Z","timestamp":1558152532000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-20005-3_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,4,28]]},"ISBN":["9783030200046","9783030200053"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-20005-3_2","relation":{},"ISSN":["2194-5357","2194-5365"],"issn-type":[{"value":"2194-5357","type":"print"},{"value":"2194-5365","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,4,28]]},"assertion":[{"value":"28 April 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"CISIS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Computational Intelligence in Security for Information Systems Conference","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Seville","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Spain","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13 May 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 May 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"cisis2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/2019.cisisconference.eu\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}