System call sequence data enhancement method for host intrusion detection

Abstract

The present invention relates to a system call sequence data enhancement method for host intrusion detection, which belongs to the field of computer and cyberspace security. The present invention first uses minority class samples to construct a system call sequence pair database; then converts the sequence data into graph structure data to better characterize the relationship between system calls; then uses a graph conversion network based on a multi-head attention mechanism and an LSTM network to respectively construct a graph encoder and a sequence decoder to learn the temporal dependencies contained in the behavioral semantics of the system call sequence; finally, based on the system call temporal dependencies, a minority class system call sequence samples are cyclically generated to achieve data enhancement of the minority class samples. The present invention can make up for the problem that the existing system call data enhancement method does not fully exploit and utilize sequence information, resulting in the semantic inconsistency between the generated sequence and the original sequence, and generates enhanced samples that reflect the sample sequence relationship, effectively improving the detection accuracy of host intrusion detection.

Description

Technical Field

[0001] The present invention relates to a data enhancement method, in particular to a system call sequence data enhancement method for host intrusion detection, belonging to the field of computer and network space security. Background Art

[0002] System calls are kernel functions implemented by the operating system and provided to applications for invocation. They can be captured in real time, enabling comprehensive monitoring of system behavior. Therefore, a sequential system call sequence, consisting of system calls, is an important data source for determining whether a host system is under attack. However, the number of attack samples in a system call sequence is far less than the number of normal samples. This data imbalance severely impacts the training of intrusion detection models based on system call sequence data. To improve the detection performance of the detection model, it is necessary to increase the amount of minority class samples used for model training to achieve a balance between the data volumes of different samples. Data augmentation is an effective means of addressing data imbalance. Its basic idea is to generate a synthetic dataset that covers the unexplored input space while maintaining correct labels. Currently, effective data augmentation methods for system call sequences include the traditional SMOTE oversampling method and GAN-based data augmentation methods.

[0003] 1. SMOTE oversampling method

[0004] The SMOTE oversampling method can synthesize new minority class samples, but it may change the distribution of the original data and lead to overfitting. It also introduces noise when synthesizing samples by ignoring the boundaries between majority and minority samples, and cannot fully explore and utilize the order and relationship of system calls in the sequence.

[0005] 2. GAN-based data enhancement method

[0006] Using traditional GAN ​​methods for image data augmentation is a common practice in computer vision. This approach involves adding noise to images. While small changes to pixels in an image don't alter the semantics of the image as a whole, converting the system call sequence into an image format for data augmentation does.

[0007] In summary, existing system call sequence data enhancement methods fail to fully exploit the order and relationships of system calls in a sequence, resulting in semantic inconsistencies between the generated data and the original data. To address this issue, the present invention proposes a system call sequence data enhancement method that can extract data for host intrusion detection. Summary of the Invention

[0008] The purpose of the present invention is to solve the problem that the current data enhancement method based on system call sequence does not fully explore and utilize the order of system calls in the sequence and their relationship information, and propose a system call sequence data enhancement method for host intrusion detection.

[0009] The design principle of the present invention is as follows: first, a system call sequence pair database is constructed using minority system call sequence samples, and the sequence data is divided into source sequence and target sequence; then, the sequence data is converted into graph structure data to better characterize the relationship between system calls; then, a graph conversion network based on a multi-head attention mechanism and an LSTM network are used to respectively construct the encoder and decoder of the Graph2seq model to learn the temporal dependencies contained in the behavioral semantics of the system call sequence; finally, the system call temporal dependencies learned by the Graph2seq model are cyclically generated to generate minority system call sequence samples to achieve data enhancement for the minority samples.

[0010] The technical solution of the present invention is achieved through the following steps:

[0011] Step 1: Establish a system call vocabulary and use minority class samples to build a system call sequence pair database as an enhanced data source.

[0012] Step 1.1, build a vocabulary containing all system calls.

[0013] In step 1.2, a sequence of length N is intercepted from the original sequence through a sliding window, and the continuous system call sequence is divided into a source sequence and a target sequence. Then, an initial sequence pair database is constructed based on the minority class system call sequence samples.

[0014] Step 2: Convert the sequence pair data into graph structure data to better represent the relationship between system calls. Then, set global nodes to represent global information and construct an unlabeled bipartite graph.

[0015] Step 2.1: Convert the sequence pair data into graph structure data to better represent the relationship between system calls.

[0016] In step 2.2, a global node is set to connect all nodes as a representation of global information and is also used to initialize the decoder.

[0017] In step 2.3, set the edge nodes to replace the labeled edges and convert the graph structure in step 2.1 into an unlabeled bipartite graph.

[0018] Step 3: Build a Graph2seq model based on the Encoder-Decoder architecture to realize the conversion from Graph to sequence, and generate sequences in a cyclic manner to obtain the minority system call sequence samples after data enhancement.

[0019] In step 3.1, use the Graph Transformer based on the multi-head attention mechanism as the encoder of the Graph2seq model to extract the system call sequence features and obtain the node encoding.

[0020] In step 3.2, the LSTM network based on the multi-head attention mechanism is used as the decoder of the Graph2seq model to decode the node encoding. The probability of the system call in the target sequence is predicted by performing a dot product calculation on the attention semantic vector of the previous moment and the hidden state of the decoder time step, and then using the softmax function.

[0021] In step 3.3, set up the sample generation module, select the system call with the highest probability of occurrence and splice it to the end of the sequence, and perform sequence generation in a cyclic manner to obtain the minority system call sequence samples after data enhancement.

[0022] Beneficial effects

[0023] Compared with the traditional SMOTE-based data enhancement method, the present invention can directly perform data enhancement on the system call sequence without changing the distribution of the original data. It fully mines and utilizes the order and relationship of system calls in the sequence to generate a system call sequence that is semantically consistent with the original data.

[0024] Compared with the GAN-based data augmentation method, the present invention can learn the semantic information of the system call sequence and generate a synthetic dataset with unchanged semantic features while maintaining the correct labels. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the system call sequence data enhancement method for host intrusion detection according to the present invention.

[0026] Figure 2 Graph structure data converted from sequence pair data. DETAILED DESCRIPTION

[0027] In order to better illustrate the purpose and advantages of the present invention, the implementation of the method of the present invention is further described in detail below with reference to examples.

[0028] Step 1: Establish a vocabulary library for system calls and use minority class samples to build a sequence pair database as an enhanced data source.

[0029] Step 1.1, build a vocabulary containing all system calls. For a certain operating system, the total number of system calls num has been determined, and the set of all system calls in the operating system is defined as S = {1, 2, ..., num}. The source system call sequence can be expressed as (x1, x2, ..., x n), the target system call sequence can be expressed as (y1, y2, ..., y m ), where x i ,y j ∈S.

[0030] Step 1.2: Select the top k N-gram system call original sequences from the minority class samples. Length is the length of the source sequence in the sequence pair database. The calculation method of k is shown in formula (1).

[0031] k=Num most -Num minorit (1)

[0032] where Num most Indicates the number of majority samples in the training set, Num minority Indicates the number of minority samples in the training set, that is, after generating k samples, the ratio of positive and negative samples is 1:1. In the original sequence, a sequence of length Length is intercepted through a sliding window, and the continuous system call sequence is used to build the initial sequence pair database. According to formula (2) and formula (3), the sequence of length Length is divided into sequences of length L. source The source sequence and length is L target The target sequence is divided into two parts, and the split coefficient is α.

[0033]

[0034] Length = L source +L target (3)

[0035] Step 2: Convert the sequence pair data into graph structure data to better represent the relationship between system calls. Then, set global nodes to represent global information and construct an unlabeled bipartite graph.

[0036] Step 2.1, consider system calls as nodes of the graph, and use edges R to represent the relationship between system calls. Each edge connects two nodes, expressed as That is x j In x i It is then called to convert each source sequence in the sequence pair database into a directed graph G, converting the data in the sequence pair database into a graph structure, thus achieving the Sequence to Graph conversion. Let G = (V, E), where V is the list of all nodes and E is the adjacency matrix describing the directed edges.

[0037] In step 2.2, a global node is set to connect all nodes as a representation of global information to promote the flow of global information. At the same time, this global node G will be used to initialize the decoder.

[0038] Step 2.3, reconstruct the graph G in step 2.1 into an unlabeled bipartite graph. The specific operation is, if there is Mark the edge Replace it with a node, and call such a node an edge node, representing x j In x i The relationship is then called. Connect this edge node to the node x connected by the original edge. i With node x j The final structure of these reconstruction operations is an unlabeled directed graph.

[0039] Step 3: Build a Graph2seq model based on the Encoder-Decoder architecture to realize the conversion from Graph to sequence, and generate sequences in a cyclic manner to obtain the minority system call sequence samples after data enhancement.

[0040] Step 3.1, use the Graph Transformer based on the multi-head attention mechanism as the encoder of the Graph2seq model to learn the source sequence relationship features. Input the set V of all nodes in the graph 0 , denote each node as v i , the set of all nodes V 0 As shown in formula (4).

[0041]

[0042] Using N in Graph Transformer h The self-attention layer of each tap extracts the system call sequence features, and the attention weight calculated for each node is shown in formula (5). The calculation method of each independent self-attention layer is shown in formula (6). Let K represent N h The concatenation of attention heads, N i Represents v in G i Neighborhood Use the attention calculation method shown in formula (7).

[0043]

[0044] An L-layer block network is used to enhance the multi-head attention calculation layer, that is, a normalization layer (LayerNorm) and a feedforward neural network (FFN) are added after the multi-head attention layer to form a block network, as shown in formulas (8) and (9).

[0045]

[0046] The output of the block network layer L-1 is used as the input of layer L, as shown in formula (10).

[0047]

[0048] Finally, we get the node code V L =[V i l ].

[0049] Step 3.2: Use the LSTM network as a decoder to decode the node code, use the multi-head attention mechanism to emphasize certain system call sequences that can better reflect the program behavior, and calculate the attention semantic vector C t , as shown in formula (11).

[0050]

[0051] C t-1 and the hidden state h at the decoder time step t Calculated by dot multiplication method Then the output probability p of the system call is calculated by formula (12), W s is the weight matrix.

[0052]

[0053] In step 3.3, set up the sample generation module and select the system calls with the highest probability of occurrence to generate enhanced minority system call sequence samples. This generated sequence is appended to the end of the input sequence, with the initial sequence length used as the model input sequence length. The recalculated input sequence is used as the model input to generate a new output sequence. This is repeated in a loop to generate data-enhanced minority system call sequence samples.

[0054] Test Results: The ADFA-LD dataset was first partitioned to construct an unbalanced training dataset. For the ADFA-LD dataset, 70% of the samples in the training and attack sets and 50% of the samples in the validation set were selected to form the training set with an imbalance ratio of 5:3. The remaining samples served as the test set.

[0055] The data augmentation method proposed in this paper is used to expand the minority class samples in the training set. The minority class training samples, the training samples generated through data augmentation, and the majority class training samples are merged to achieve a 1:1 ratio of positive and negative samples in the expanded training set. The BLEU metric is then used to evaluate the quality of the generated training samples. When the split coefficient α and window size Length are appropriately set, a maximum BLEU value of 83.5% is achieved, demonstrating that this method has a strong ability to capture sequence order and relationships.

[0056] Finally, an intrusion detection model was constructed based on the BonG method and trained and tested using the SVM, MLP, and RF algorithms. The above methods were used to train and test the ADFA-LD dataset before and after data enhancement. The F-value of the intrusion detection using the data enhancement method improved by 22.5% (SVM), 5.2% (MLP), and 4.8% (RF), respectively, effectively improving the detection performance of host intrusion detection.

[0057] The above specific description further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A system call sequence data enhancement method for host intrusion detection, characterized in that The method comprises the following steps: Step 1: Establish a vocabulary of system calls and use minority class samples to build a system call sequence database as an enhanced data source; Step 2: Convert the sequence pair data into graph structure data to better represent the relationship between system calls. Then, set global nodes to represent global information and construct an unlabeled bipartite graph. Step 3: Establish a Graph2seq model based on the Encoder-Decoder architecture, use the Graph Transformer based on the multi-head attention mechanism as the model encoder to encode the nodes, use the LSTM network based on the multi-head attention mechanism as the model decoder to output the probability of occurrence of system calls, select the system call with the highest probability of occurrence and splice it to the end of the sequence, and generate sequences in a cyclic manner to obtain the minority class system call sequence samples after data enhancement.

2. The system call sequence data enhancement method for host intrusion detection according to claim 1, characterized in that: In step 1, the original sequence of the top k N-grams ranked by frequency is selected from the minority class samples, where k is the difference between the number of majority samples and minority samples in the training set. The original sequence is then truncated to a sequence of fixed length through a sliding window and divided into source sequence and target sequence to construct a sequence pair database.

3. The system call sequence data enhancement method for host intrusion detection according to claim 1, characterized in that: In step 2, the system call sequence is converted into a relationship graph, where the system calls are regarded as nodes of the graph and the edges are the relationships between the system calls; Set the global node, set the edge node to replace the marked edge to build an unmarked bipartite graph, and realize the conversion from Sequence to graph.

Images