Intrusion Prediction With System-Call Sequence-to-Sequence Model

The advanced development of the Internet facilitates efficient information exchange while also been exploited by adversaries. Intrusion detection system is an important defense component of network security that has always been widely studied in security research. However, the research of intrusion prediction, which is more critical for network security, received less attention. General research methods regarding prediction are analyzing short term of system-calls to predict forthcoming abnormal behaviors. However, those approaches have poor accuracy due to their limited sequence dependency. To solve this problem, in this paper, we take advantage of the remarkable performance of recurrent neural networks in dealing with long sequential problems, introducing the sequence-to-sequence model into our intrusion prediction work. By semantically modeling system-calls, we build a robust system-call sequence-to-sequence prediction model. Our prediction model predicts a sequence of system-calls that will be executed in the future, which will enable the monitoring of system state and the prediction of attack behavior. The experiments show that the prediction method proposed in this paper achieved well prediction performance on ADFA-LD intrusion detection test data set. Moreover, the predicted sequence, combined with the known invoked traces of system call, significantly improves the performance of intrusion detection verified on various classifiers.