{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T06:47:20Z","timestamp":1777704440251,"version":"3.51.4"},"reference-count":57,"publisher":"SAGE Publications","issue":"5","license":[{"start":{"date-parts":[[2020,2,17]],"date-time":"2020-02-17T00:00:00Z","timestamp":1581897600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"published-print":{"date-parts":[[2020,5,29]]},"abstract":"<jats:p>\u00a0It is not foolproof for intrusion detection to focus only on the network level and the program level. Internal security and external security of information systems should be given equal attention. User-level intrusion detection can deter and curtail attackers from damaging information systems. Even if the mimic attacker has gained and enhanced the host user privileges that he illegally obtained. In this paper, a novel method based on recurrent neural networks (RNNs) is used to predict user command sequences and prophesy user behaviors. The experimental results show that our command sequence-to-sequence model is robust and effective for solving long sequential problem on three different data sets including Purdue University data set, SEA data set and self-collected data set.<\/jats:p>","DOI":"10.3233\/jifs-179659","type":"journal-article","created":{"date-parts":[[2020,2,18]],"date-time":"2020-02-18T12:43:02Z","timestamp":1582029782000},"page":"5707-5716","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":4,"title":["A new approach of user-level intrusion detection with command sequence-to-sequence model"],"prefix":"10.1177","volume":"38","author":[{"given":"Wei","family":"Liu","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Beijing Institute of Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Mao","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Beijing Institute of Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Linlin","family":"Ci","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Beijing Institute of Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fuquan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Fujian Provincial Key Laboratory of Information Processing and Intelligent Control,  Minjiang University, Fuzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2020,2,17]]},"reference":[{"issue":"6","key":"e_1_3_1_2_2","first-page":"1717","article-title":"Alpha-Fraction First Strategy for Hierarchical Wireless Sensor Networks","volume":"19","author":"Pan J.-S.","year":"2018","unstructured":"PanJ.-S., KongL., SungT.-W., TsaiP.-W. and SnaselV., Alpha-Fraction First Strategy for Hierarchical Wireless Sensor Networks, Journal of Internet Technology19(6) (2018),1717\u20131726.","journal-title":"Journal of Internet Technology"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1109\/TVLSI.2019.2903289"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1080\/02533839.2018.1537807"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-018-1029-3"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2891105"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","unstructured":"WuJ.M.-T. LinJ.C.-W. and TamrakarA. High-Utility Itemset Mining with Effective Pruning Strategies ACM Transactions on Knowledge Discovery from Data https:\/\/doi.org\/10.1145\/3363571 (2019).","DOI":"10.1145\/3363571"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.3233\/JIFS-179131"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.3233\/JIFS-179109"},{"key":"e_1_3_1_10_2","unstructured":"LaneT.D. Machine learning techniques for the computer security domain of anomaly detection Purdue University (2001)."},{"issue":"1","key":"e_1_3_1_11_2","first-page":"58","article-title":"Computer intrusion: Detecting mas querades","volume":"16","author":"Matthias S.","year":"2001","unstructured":"MatthiasS., Computer intrusion: Detecting mas querades, Statistic Science16(1) (2001),58\u201374.","journal-title":"Statistic Science"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2004.823851"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.08.003"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0190938"},{"key":"e_1_3_1_15_2","doi-asserted-by":"crossref","unstructured":"VemparalaS. Di TroiaF. CorradoV.A. et al. Malware detetection using dynamic birthmarks IWSPA (2016) 41\u201346.","DOI":"10.1145\/2875475.2875476"},{"issue":"8","key":"e_1_3_1_16_2","first-page":"1555","article-title":"Mining user cross-domain behavior patterns for insider threat detection","volume":"39","author":"Yu W.","year":"2016","unstructured":"YuW., Wei-PingW. and DanM., Mining user cross-domain behavior patterns for insider threat detection, China Journal Computer39(8) (2016),1555\u20131569.","journal-title":"China Journal Computer"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1023\/B:AIRE.0000045502.10941.a9"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.184"},{"key":"e_1_3_1_19_2","unstructured":"StolfoS.J. Ben SalemM. and HershkopS. Methods systems and media for masquerade attack detection by monitoring computer user behavior: US US9311476 (2016)."},{"key":"e_1_3_1_20_2","doi-asserted-by":"crossref","unstructured":"EmmottA.F. DasS. and DietterichT. et al. Systematic construction of anomaly detection benchmarks from real data. SIGKDD (2015) 16\u201321.","DOI":"10.1145\/2500853.2500858"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.2329428"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-444-53859-8.00014-X"},{"issue":"2","key":"e_1_3_1_23_2","first-page":"1","article-title":"Hybrid modified K-Means with C4.5 for intrusion detection systems in multiagent systems","volume":"2015","author":"Al-Yaseen W.L.","year":"2015","unstructured":"Al-YaseenW.L., OthmanZ.A. and NazriM.Z.A., Hybrid modified K-Means with C4.5 for intrusion detection systems in multiagent systems, The Scientific World J2015(2) (2015),1\u201314.","journal-title":"The Scientific World J"},{"key":"e_1_3_1_24_2","doi-asserted-by":"crossref","unstructured":"SahuS.K. and JenaS.K. A multiclass SVM classification approach for Intrusion detection IDCS (2016)","DOI":"10.1007\/978-3-319-28034-9_23"},{"key":"e_1_3_1_25_2","doi-asserted-by":"crossref","unstructured":"AbdullahA. PonnanR. and AsirvathamD. Improving multiclass classification in intrusion detection using clustered linear separator analytics ISMS (2018) 32\u201337.","DOI":"10.1109\/ISMS.2018.00016"},{"issue":"4","key":"e_1_3_1_26_2","first-page":"1319","article-title":"Cherukuri, Intrusion detection model using fusion of chi-square feature selection and multi class SVM","volume":"29","author":"Sumaiya T.I.","year":"2016","unstructured":"SumaiyaT.I. and KumarA., Cherukuri, Intrusion detection model using fusion of chi-square feature selection and multi class SVM, JKSU-CIS29(4) (2016),1319\u20131578.","journal-title":"JKSU-CIS"},{"key":"e_1_3_1_27_2","doi-asserted-by":"crossref","unstructured":"ThaseenI.S. and KumarC.A. Intrusion detection model using fusion of PCA and optimized SVM. IC3I. 879\u2013884 (2015).","DOI":"10.1109\/IC3I.2014.7019692"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.08.007"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.3390\/e17042367"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2012.12.002"},{"key":"e_1_3_1_31_2","doi-asserted-by":"crossref","unstructured":"YinM. YaoD. LuoJ. et al. Network backbone anomaly detection using double random forests based on non-extensive entropy feature extraction ICNC (2014) 80\u201384.","DOI":"10.1109\/ICNC.2013.6817948"},{"key":"e_1_3_1_32_2","doi-asserted-by":"crossref","unstructured":"LiuD. LungC.H. SeddighN. et al. Entropy-based robust PCA for communication network anomaly detection ICCC (2014) 171\u2013175.","DOI":"10.1109\/ICCChina.2014.7008266"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2014.06.018"},{"key":"e_1_3_1_34_2","doi-asserted-by":"crossref","unstructured":"WangZ. YangJ. and LiF. An on-line anomaly detection method based on a new stationarymetric-entropy-ratio IEEE 13th International Conference on Trust Security and Privacy in Computing and Communications (TrustCom) (2014) 175\u2013192.","DOI":"10.1109\/TrustCom.2014.16"},{"key":"e_1_3_1_35_2","doi-asserted-by":"crossref","unstructured":"Berezi\u0144skiP. SzpyrkaM. JasiulB. et al. Network anomaly detection using parameterized entropy CISIM (2014).","DOI":"10.1007\/978-3-662-45237-0_43"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.bjp.2013.10.014"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/TST.2016.7590319"},{"key":"e_1_3_1_38_2","unstructured":"TangY. LiuZ. PanM. et al. Detection of magnetic anomaly signal based on information entropy of differential signal IEEE Geosci Remote S (2018) 1\u20135."},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"issue":"11","key":"e_1_3_1_40_2","first-page":"1989","article-title":"Handwritten digit recognition:","volume":"27","author":"Lecun Y.","unstructured":"LecunY., JackelL.D., BoserB., et al., Handwritten digit recognition:, Applications of neural network chips and automatic learning27(11), 1989.","journal-title":"Applications of neural network chips and automatic learning"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","DOI":"10.1038\/323533a0"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","DOI":"10.1162\/neco.2006.18.7.1527"},{"key":"e_1_3_1_43_2","unstructured":"HintonG.E. and McClellandJ.L. Learning representations by recirculation Proceeding of the 1st Int Conference on Neural Information Systems Cambridge MA: MIT Press (1987) 358\u2013366."},{"key":"e_1_3_1_44_2","doi-asserted-by":"crossref","unstructured":"DahlG.E. StokesJ.W. DengL. and YuD. Large-scale malware classification using random projections and neural networks 2013 IEEE International Conference on Acoustics Speech and Signal Processing (ICASSP) (2013).","DOI":"10.1109\/ICASSP.2013.6638293"},{"key":"e_1_3_1_45_2","doi-asserted-by":"crossref","unstructured":"PascanuR. StokesJ.W. SanossianH. MarinescuM. and ThomasA. Malware classificationwith recurrent networks IEEE International Conference on Acoustics (2015).","DOI":"10.1109\/ICASSP.2015.7178304"},{"key":"e_1_3_1_46_2","unstructured":"JozefowiczR. ZarembaW. and SutskeverI. An Empirical Exploration of Recurrent Network Architectures International Conference on International Conference on Machine Learning (2015)."},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.05.010"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.08.007"},{"key":"e_1_3_1_49_2","unstructured":"DebarH. BeckerM. and SiboniD. A Neural Network Component for an Intrusion Detection System IEEE Symposium on Security & Privacy (1992)."},{"key":"e_1_3_1_50_2","doi-asserted-by":"crossref","unstructured":"NixR. and JianZ. Classification of Android apps and malware using deep neural networks International Joint Conference on Neural Networks (2017).","DOI":"10.1109\/IJCNN.2017.7966078"},{"key":"e_1_3_1_51_2","unstructured":"ZaheerM. TristanJ.B. WickM.L. et al. Learning a static analyzer: A case study on a toy language [EB\/OL]. (2016)."},{"key":"e_1_3_1_52_2","doi-asserted-by":"crossref","unstructured":"GodefroidP. PelegH. and SinghR. Learn&fuzz: Machine learning for input fuzzing (2017).","DOI":"10.1109\/ASE.2017.8115618"},{"issue":"6","key":"e_1_3_1_53_2","first-page":"175","article-title":"Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks","volume":"8","author":"Melicher W.","year":"2016","unstructured":"MelicherW., UrB., SegretiS.M., et al., Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks, Journal of Networks8(6) (2016),175\u2013191.","journal-title":"Journal of Networks"},{"key":"e_1_3_1_54_2","unstructured":"HuW. and TanY. Black-box attacks against RNN based mal-ware detection algorithms (2017)."},{"key":"e_1_3_1_55_2","doi-asserted-by":"crossref","unstructured":"RosenbergI. ShabtaiA. RokachL. and EloviciY. Generic black-box end-to-end attack against state of the art API call based malware classifiers (2017).","DOI":"10.1007\/978-3-030-00470-5_23"},{"key":"e_1_3_1_56_2","unstructured":"GrosseK. PapernotN. ManoharanP. BackesM. and McdanielP. Adversarial perturbations against deep neural networks for malware classification. (2016)."},{"key":"e_1_3_1_57_2","unstructured":"PapernotN. McdanielP. SinhaA. and WellmanM. Towards the science of security and privacy in machine learning (2016)."},{"key":"e_1_3_1_58_2","doi-asserted-by":"crossref","unstructured":"AthiwaratkunB. and StokesJ.W. Malware classification with LSTM and GRU language models and a character-level CNN IEEE International Conference on Acoustics (2017).","DOI":"10.1109\/ICASSP.2017.7952603"}],"container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JIFS-179659","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JIFS-179659","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JIFS-179659","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T09:41:13Z","timestamp":1777455673000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JIFS-179659"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,2,17]]},"references-count":57,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2020,5,29]]}},"alternative-id":["10.3233\/JIFS-179659"],"URL":"https:\/\/doi.org\/10.3233\/jifs-179659","relation":{},"ISSN":["1064-1246","1875-8967"],"issn-type":[{"value":"1064-1246","type":"print"},{"value":"1875-8967","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,2,17]]}}}