{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T17:00:52Z","timestamp":1785862852940,"version":"3.56.0"},"reference-count":28,"publisher":"Oxford University Press (OUP)","issue":"2","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"funder":[{"name":"Bavarian State Ministry of Science and Arts in the framework of the Centre Digitization.Bavaria"},{"name":"BayWISS Consortium Digitization"},{"name":"NVIDIA Corporation"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,3,25]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Over the years, artificial neural networks have been applied successfully in many areas including IT security. Yet, neural networks can only process continuous input data. This is particularly challenging for security-related, non-continuous data like system calls of an operating system. This work focuses on five different options to preprocess sequences of system calls so that they can be processed by neural networks. These input options are based on one-hot encodings and learning word2vec, GloVe or fastText representations of system calls. As an additional option, we analyse if mapping system calls to their respective kernel modules is an adequate generalization step for (i) replacing system calls or (ii) enhancing system call data with additional information regarding their context. When performing such preprocessing steps it is important to ensure that no relevant information is lost during the process. The overall objective of system call analysis in the context of IT security is to categorize a sequence of them as benign or malicious behavior. Therefore, this scenario is used to evaluate different system call representations in a classification task. Results indicate that a broader range of attacks can be detected when enriching system call representations with corresponding kernel module information. Prior learning of embeddings does not achieve significant improvements. This work is an extension of the work by Wunderlich et al. [1] published in Advances in Intelligent Systems and Computing (AISC, volume 951).<\/jats:p>","DOI":"10.1093\/jigpal\/jzaa058","type":"journal-article","created":{"date-parts":[[2020,9,28]],"date-time":"2020-09-28T19:16:19Z","timestamp":1601320579000},"page":"239-251","source":"Crossref","is-referenced-by-count":4,"title":["The Impact of Different System Call Representations on Intrusion Detection"],"prefix":"10.1093","volume":"30","author":[{"given":"Sarah","family":"Wunderlich","sequence":"first","affiliation":[{"name":"Coburg University of Applied Sciences and Arts, Coburg, 96450, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Markus","family":"Ring","sequence":"additional","affiliation":[{"name":"Coburg University of Applied Sciences and Arts, Coburg, 96450, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dieter","family":"Landes","sequence":"additional","affiliation":[{"name":"Coburg University of Applied Sciences and Arts, Coburg, 96450, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Andreas","family":"Hotho","sequence":"additional","affiliation":[{"name":"Data Science Chair, University of W\u00fcrzburg, W\u00fcrzburg, 97070, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2020,10,30]]},"reference":[{"key":"2022032112112222000_ref1","first-page":"14","article-title":"Comparison of system call representations for intrusion detection","volume-title":"International Conference on Computational Intelligence in Security for Information Systems (CISIS 2019)","author":"Wunderlich","year":"2019"},{"key":"2022032112112222000_ref2","doi-asserted-by":"crossref","first-page":"807","DOI":"10.1109\/TC.2013.13","article-title":"A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns","volume":"63","author":"Creech","year":"2014","journal-title":"IEEE Transactions on Computers"},{"key":"2022032112112222000_ref3","first-page":"120","article-title":"A sense of self for Unix processes","volume-title":"IEEE Symposium on Security and Privacy","author":"Forrest","year":"1996"},{"key":"2022032112112222000_ref4","doi-asserted-by":"crossref","first-page":"151","DOI":"10.3233\/JCS-980109","article-title":"Intrusion detection using sequences of system calls","volume":"6","author":"Hofmeyr","year":"1998","journal-title":"Journal of Computer Security"},{"key":"2022032112112222000_ref5","first-page":"1","article-title":"LSTM-based system-call language modeling and robust ensemble method for designing host-based intrusion detection systems","author":"Kim","year":"2016"},{"key":"2022032112112222000_ref6","first-page":"137","article-title":"Deep learning for classification of malware system call sequences","volume-title":"Australasian Joint Conference on Artificial Intelligence (AI)","author":"Kolosnjaji","year":"2016"},{"key":"2022032112112222000_ref7","doi-asserted-by":"crossref","first-page":"488","DOI":"10.1016\/j.cose.2007.10.003","article-title":"Intrusion detection using text processing techniques with a kernel based similarity measure","volume":"26","author":"Sharma","year":"2007","journal-title":"Computers & Security"},{"key":"2022032112112222000_ref8","first-page":"431","article-title":"A host-based anomaly detection approach by representing system calls as states of kernel modules","volume-title":"IEEE Symposium on Software Reliability Engineering (ISSRE)","author":"Murtaza","year":"2013"},{"key":"2022032112112222000_ref9","doi-asserted-by":"crossref","first-page":"170","DOI":"10.1109\/CISDA.2015.7208644","article-title":"A trace abstraction approach for host-based anomaly detection","volume-title":"IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA)","author":"Murtaza","year":"2015"},{"key":"2022032112112222000_ref10","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Computation"},{"key":"2022032112112222000_ref11","doi-asserted-by":"crossref","first-page":"4487","DOI":"10.1109\/WCNC.2013.6555301","article-title":"Generation of a new IDS test dataset: time to retire the KDD collection","volume-title":"IEEE Wireless Communications and Networking Conference (WCNC)","author":"Creech","year":"2013"},{"key":"2022032112112222000_ref12","first-page":"165","article-title":"Modeling system calls for intrusion detection with dynamic window sizes","volume-title":"DARPA Information Survivability Conference & Exposition II (DISCEX)","author":"Eskin","year":"2001"},{"key":"2022032112112222000_ref13","first-page":"470","article-title":"An efficient hidden Markov model training scheme for anomaly intrusion detection of server applications based on system calls","volume-title":"IEEE International Conference on Networks (ICon)","author":"Hoang","year":"2004"},{"key":"2022032112112222000_ref14","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/52.605929","article-title":"Intrusion detection via system call traces","volume":"14","author":"Kosoresow","year":"1997","journal-title":"IEEE Software"},{"key":"2022032112112222000_ref15","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1007\/978-1-4615-0953-0_4","article-title":"A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data","volume":"6","author":"Eskin","year":"2002","journal-title":"Applications of Data Mining in Computer Security"},{"key":"2022032112112222000_ref16","first-page":"358","article-title":"Anomaly intrusion detection using one class SVM","volume-title":"IEEE SMC Information Assurance Workshop","author":"Wang","year":"2004"},{"key":"2022032112112222000_ref17","first-page":"9","article-title":"Host based intrusion detection system with combined CNN\/RNN model","volume-title":"International Workshop on AI in Security","author":"Chawla","year":"2018"},{"key":"2022032112112222000_ref18","doi-asserted-by":"crossref","first-page":"542","DOI":"10.1007\/978-3-319-11698-3_44","article-title":"Evaluating host-based anomaly detection systems: application of the frequency-based algorithms to ADFA-LD","volume-title":"International Conference on Network and System Security","author":"Xie","year":"2014"},{"key":"2022032112112222000_ref19","first-page":"3111","article-title":"Distributed representations of words and phrases and their compositionality","volume-title":"Advances in Neural Information Processing Systems","author":"Mikolov","year":"2013"},{"key":"2022032112112222000_ref20","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1162\/tacl_a_00051","article-title":"Enriching word vectors with subword information","volume":"5","author":"Bojanowski","year":"2017","journal-title":"Transactions of the Association for Computational Linguistics"},{"key":"2022032112112222000_ref21","doi-asserted-by":"crossref","first-page":"1532","DOI":"10.3115\/v1\/D14-1162","article-title":"GloVe: global vectors for word representation","volume-title":"Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)","author":"Pennington","year":"2014"},{"key":"2022032112112222000_ref22","first-page":"657","article-title":"IP2Vec: learning similarities between IP adresses","volume-title":"Workshop on Data Mining for Cyber Security (DMCS), International Conference on Data Mining Workshops (ICDMW)","author":"Ring","year":"2017"},{"key":"2022032112112222000_ref23","article-title":"Dataset"},{"key":"2022032112112222000_ref24"},{"key":"2022032112112222000_ref25","first-page":"133","article-title":"Detecting Intrusions Using System Calls: Alternative Data Models","author":"Warrender","year":"1999"},{"key":"2022032112112222000_ref26","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Transactions on Information and System Security (TISSEC)"},{"key":"2022032112112222000_ref27","doi-asserted-by":"crossref","first-page":"1263","DOI":"10.1109\/TKDE.2008.239","article-title":"Learning from imbalanced data","volume":"21","author":"He","year":"2009","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"2022032112112222000_ref28","first-page":"115","article-title":"Learning precise timing with LSTM recurrent networks","volume":"3 (Aug)","author":"Gers","year":"2002","journal-title":"Journal of Machine Learning Research"}],"container-title":["Logic Journal of the IGPL"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/jigpal\/article-pdf\/30\/2\/239\/42901432\/jzaa058.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/jigpal\/article-pdf\/30\/2\/239\/42901432\/jzaa058.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,3,21]],"date-time":"2022-03-21T12:15:53Z","timestamp":1647864953000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jigpal\/article\/30\/2\/239\/5943971"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":28,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2020,10,30]]},"published-print":{"date-parts":[[2022,3,25]]}},"URL":"https:\/\/doi.org\/10.1093\/jigpal\/jzaa058","relation":{},"ISSN":["1367-0751","1368-9894"],"issn-type":[{"value":"1367-0751","type":"print"},{"value":"1368-9894","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2022,4]]},"published":{"date-parts":[[2020,10,30]]}}}