Towards a better similarity algorithm for host-based intrusion detection system

3.1 Hamming distance

The Hamming distance is equivalent to the minimum number of substitutions required to move from the representation of string 1 to that of string 2 . The substitution corresponds to replacing an element in the representation of string 1 with a new element to get closer to the representation of string 2 [20].

Let E be an alphabet of symbols and C a subset of E n , the set of words of length n over E . Let A = ( a 1 , … , a 2 ) and B = ( b 1 , … , b 2 ) be words in C . The Hamming distance d ( A , B ) is defined as the number of places in which A and B differ, that is

The Hamming distance satisfies

3.2 Levenshtein distance

The number of adjustments needed to convert one string into another is counted to determine this distance. This algorithm modifies the first string to match the second one using insertion, deletion, and replacement. The Levenshtein distance between two strings A and B is given by Lev A , B ( | A | , | B | ) [21], where:

3.3 Jaro–Winkler distance

Two strings receive high scores from this method, if (1) they have matching characters close to one another and (2) the matching characters are in the same order. The Winkler algorithm, therefore, increases the Jaro similarity measure for equivalent initial characters.

where sim jw ( A , B ) is the similarity of Jaro–Winkler, sim j ( A , B ) is the similarity of Jaro, l is the length of the same prefix at the beginning of both strings, up to a maximum of 4. p is used as the scalar. The scaling factor must not be greater than 0.25. If not, the similarity could go beyond 1 because the prefix being considered can only be four letters long. Original Winkler’s work used a value of 0.1.

where m is the number of matching characters. Two characters from A and B are identical if they do not differ by more than max ( | A | , | B | ) 2 − 1 characters apart [19].

3.4 Jaccard index

For this case of set similarity, the approach is to find the number of common tokens between two sets and divide it by the total number of unique tokens. It is described mathematically as follows [22]:

where A and B are two strings that have to be tokenized by the user. In our defined prototype, we tokenize the sequence of system call contained in the attack folder using space as a delimiter converting system call numbers to tokens.

3.5 Dice coefficient

For this case of set similarity, the approach is to combine the two sets and look for the common tokens, then divide those by the total number of tokens.

It is based on the idea that if a token appears in both strings, its total count must be twice the intersection when the intersection of two sets of strings is doubled in the numerator (which removes duplicates). The tokens in both strings are combined to form the denominator. Recall that the denominator of Jaccard’s equation was the union of two strings; this one is very different. Like intersections, the union also eliminates duplicates, and the dice mechanism prevents this. Dice will constantly overstate how similar two strings are [23].

4.1 ADFA-LD dataset and its preprocessing

Linux dataset ADFA-LD was created by Creech and Hu [5] using an auditing tool named auditd.

It was compiled using the fully patched Ubuntu 11.04 operating system and kernel 2.6.38. Numerous services, including a web server, database server, SSH server, FTP server, etc., are being run by the operating system to capture sequences that represent attack and normal sequences.

As shown in Table 2, the ADFA-LD is divided into three distinct data folders; each folder has its system call trace files. The Training data master (TDM) folder and Validation data master (VDM) folder represent the normal data. On the other hand, Attack data master (ADM) represents attack data. ADM folder includes six other attack data types: “Adduser,” “Hydra-FTP,” “Hydra-SSH,” “JavaMeterpreter,” “Meterpreter,” and “Web shell.”

The preprocessing in this approach consists of dividing the ADM folder into a set of groups. The other two TDM/VDM folders are not divided. After thoroughly studying the ADM files, we should consider the classifications in Figure 2, Tables 3 and 4 below.

Figure 2

Folders in classification 1 for ADM.

It was noticed that all the system call traces with the same number at the end of the file name have the same system calls but with different occurrences. Therefore, classifications 2 and 3 were proposed based on this observation.

In classification 2, we partitioned the files by each type of attack. Moreover, for each type of attack, we then partitioned it into a set of groups. Each group contains files that are similar in name, as shown in Table 3. The same principle was used to define the set of groups in classification 3. However, they were defined concerning the whole set of attacks this time. Table 4 shows this distribution.

4.2 Principle of detection

The BSA normal and abnormal behavior detection algorithm is based on the following principles:

• The measures of the similarity algorithms are normalized in such a way that a similarity between two strings that approaches 0 means that the two strings are similar. Moreover, in contrast, a similarity between two strings close to 1 means that the two are different. This translates, in our case, into the coupling and decoupling factors.

• A trace attack that we want to test must be close to all the other trace attacks (the class to which it belongs depends on the classification chosen), which translates into a very low similarity. On the other hand, its similarity to the set of valid and training data must be very high.

• A valid trace we want to test must be close to all the other valid and training traces, resulting in a very low similarity. But, its similarity to all attack traces must be very high.

• The threshold by which the test is carried out is variable, relative to each trace.

Let

S be the set of all traces,

S A be the s et of all attack traces S A ⊂ S

S T be the set of all training traces S T ⊂ S

S V be the set of all validation traces S V ⊂ S

We call M / M ⊂ S A the set of all possible multisets we can create from Classification 1, Classification 2, and Classification 3.

m i , n ⊂ M is called the set of attacks number i containing n traces.

Algorithm One-to-All Trace similarity Algorithm (OATSA) calculates the average similarity of one trace to a set of trace.

Algorithm 1 : OATSA

1. Input : x single trace

2. Input : X set of traces

3. Output : float

4. s ← 0 ;

5. For i in range ( 0 , |X| ) do

6. s ← s + sim ( x , X [ i ] )

7. end For

8. r eturn ( s / |X| )

Note that in this algorithm sim can be one of the similarity measure listed above (Levenshtein, Jaro–Winkler, Jaccard, Hamming, or Dice coefficient).

Algorithm 2 : BSA

1. Input : S A , S T , S V

2. Input : x system call trace to test ( x ∊ m i ) or ( x ∊ S V )

3. Output : a decision value ‘ normal ’ or ‘ anomaly ’

4. Calculate :

5. a ← OATSA ( x , m i )

6. b ← OATSA ( x , S T )

7. c ← OATSA ( x , S V )

8. if ( a < max ( b , c ) ) then

9. return ‘ anomaly ’

10. else if ( a ≥ min ( b , c ) ) then

11. return ‘ normal ’

12. end if

where max (b,c) is the function that returns the maximum between b and c ,

min (b,c) is the function that returns the minimum between two numbers b and c .

Note that if ( a < max ( b , c ) ) is true that means we detect an attack, thus true positive (TP) value increments otherwise false negative (FN) value increments. In addition, if ( a ≥ min ( b , c ) ) is true then, true negative (TN) increments otherwise false positive (FP) increments. The two test rules in the BSA algorithm are defined based on the concept of inter-class (decoupling factor) and intra-class (coupling factor).

The intra-class distance corresponds to the distance between attacks placed in an attack set m i . A small intra-class distance between attacks belonging to the same set m i can be translated in this case by the presence of the same system call numbers in the traces of this set or by the almost identical sequence of these system call numbers. The notion of intra-class distance makes it possible to highlight the heterogeneity of the sets m i resulting from classifications 1, 2, and 3 in order to choose the best classification. The inter-class distance corresponds to the distance between the sets S A , S T , S V within the whole space of the system call traces S . The further apart they are, the stronger the inter-class distance will be.

Therefore, the distance between an attack and the set of all attacks must be less than the maximum of the average distance of that attack from all traces contained in the set S T and its average distance from all traces contained in the set S V . On the other hand, the distance between a normal trace and the set of all attacks must be greater than or equal to the minimum of the average distance of that normal trace from all traces contained in the set S T and its average distance from all traces contained in the set S V .

5.1 Experimental environment

Experiments used Python under VMware with Ubuntu 20.04.5 LTS Linux 64-bit, 24 GB in memory and 10 cores processors. The Levenshtein and Jaro–Winkler algorithms are from the Python rapidfuzz library, and the other three algorithms are from the Python textdistance library. All these algorithms are normalized so that a value that approaches 0 means that the sequences are similar, and a value that approaches 1 means that the sequences are not similar.

5.2 Evaluation metrics

With the use of the sub-metrics TPs, TNs, FPs, and FNs, we assessed and examined each classification’s performance using a confusion matrix, accuracy, FNR, FPR, precision, recall, and F1-score. For completeness, these measures are defined as follows:

Confusion matrix: Demonstrates how many accurate and inaccurate predictions a model made. It considers all factors and can visually display results for each factor, making it a common evaluation tool, especially when attempting to comprehend and enhance an algorithm’s performance.

Accuracy: The proportion of accurate classification predictions to all predictions

False negative rate (FNR): The proportion of actual positive examples for which the model incorrectly predicted the negative class.

False positive rate (FPR): The proportion of actual negative examples for which the model incorrectly predicted the positive class.

Precision: Defined as percentage of correct prediction when the model predicted the positive class.

Recall: Define percentage from the real attack instances covered by the model.

F 1-score: Combine the precision and recall metrics into a single metric.

The metrics provided above directly indicate each classifier’s performance.

5.3 Results and discussion

To avoid having many graphs, we will present the results in this section concerning classifications 1, 2, and 3.

All distances used are normalized as follows: Let S 1 , S 2 be two system call sequences.

where

Sim Levenshtein is the similarity using Levenshtein algorithm,

Sim Jaro − Winkler is the similarity using Jaro–Winkler,

Sim Jaccard is the similarity using Jaccard,

Sim Hamming is the similarity using Hamming,

Sim Dice − Coefficient is the similarity using Dice coefficient,

Rapidfuzz and textdistance are libraries in Python.

Tables 5–9 and Figures 3–7 show the performance in terms of accuracy, FNR, FPR, recall, precision, and F1-score for all three classifications under Levenshtein, Jaro–Winkler, Hamming, Jaccard, and Dice coefficient. In the first three similarity measures, we notice that classification 2 is better than the others (1 and 3). However, in the last two similarity measures, algorithms perform better with the last classification (classification 3).

Figure 3

Levenshtein results on three classifications.

Figure 4

Jaro–Winkler results on three classifications.

Figure 5

Jaccard results on three classifications.

Figure 6

Hamming results on three classifications.

Figure 7

Dice coefficient results on three classifications.

We notice that the folder named “Different” in each classification gives a signifying number of false negatives. Let us take, for example, this folder in classification 2 for the JavaMeterpreter attack and using the Levenshtein algorithm, the curve is shown in Figure 8.

Figure 8

Intrusion test curve for file named “Different.”

It can be seen from Figure 8 that the attack numbers (5, 10, 15, 20, 25, 26, 31, 42, 43, 44) are poorly detected. This is due to their textual distances, which are close to both the training and validation class and far from the attack class.

Another thing that draws our attention is that if we define a single threshold to classify the system call sequences, we will have a very high false alarm rate. Indeed, let us take the example of Figure 8. If we define a threshold of 0.5, i.e., sequences with a textual distance below 0.5 are considered as attack sequences, and those above 0.5 are considered normal sequences. Such a definition will consider all 56 sequences shown in Figure 8 as normal sequences, which are not. Thus, here we emphasize the strength of the model, which is the variable definition of the threshold that fits all system sequences.

Figure 9 and Table 10 shows a comparison according to classification 2 for the five similarity measures used. Jaro–Winkler/Dice coefficient gives the same recall value of 0.95 and the same FNR of 0.04. However, the Jaro–Winkler algorithm performs better, it gives a high value: accuracy of 0.94, precision of 0.72, and F1-score of 0.82 compared to Dice coefficient, which gives 0.90, 0.61, and 0.74 respectively. Jaccard/Hamming gives the same accuracy, 0.98, same F1-score, 0.95; however, the false positives of the Jaccard algorithm are greater than those of the Hamming algorithm. The last algorithm, Levenshtein, gives outstanding performance of 0.99 in terms of accuracy, 0.04 FNR, 0 FPR, 1 precision, 0.95 recall, and 0.97 F1-score. These excellent results are obtained because this algorithm processes the system call sequences to measure similarity.

Figure 9

Comparison of the five similarity metrics on classification 2.

Before selecting the best method and classification, another parameter is taken into consideration, the elapsed time to implement the HIDS. Each algorithm’s running times in seconds are displayed in the following table:

Table 11 represents the running time for each algorithm. We notice that Jaro–Winkler is the fastest one with 720 s, Dice coefficient with 2,940 s, Jaccard algorithm with 3,060 s, Levenshtein algorithm with 3,300 s, and finally, Hamming took a significant time processing with 14,880 s. Jaro–Winkler’s speed is due to the implementation of the rapidfuzz library, which executes this algorithm in 0.00094 s and Levenshtein in 0.00312 s. Therefore, the long time to execute the Hamming algorithm is due to its implementation in the textdistance library, which takes about 0.03531 s.

It should be noted that the version of Levenshtein’s algorithm described in the study [24] gives an accuracy of 1, FNR of 0, FPR of 0, Precision, Recall, and F1-score of 1, but the implementation time is very long, about 1 month and 15 days with the capabilities of the virtual environment described above.

From the confusion matrix in Figure 10, it can be seen in more detail that Jaccard, Hamming, and Levenshtein algorithms showed almost the same high-performance level and displayed a similar trend regarding correct and incorrect classifications. However, Jaro–Winkler and Dice coefficient showed a lower performance value than others. While having a generally higher performance in terms of elapsed time, Jaro–Winkler does have the second-highest score for FN and FP. Although this rating is not as bad as an FP rating, it is still high relative to the other algorithms, such as Levenshtein, Jaccard, Hamming, and Dice coefficient, which shows FN/FP of 30/0, 21/51, 31/43, and 35/442 respectively.

Figure 10

Confusion matrix for all algorithm/classification 2.

The thing that caught our attention was the number of false negatives obtained by each algorithm, which ranged from 21 to 35. These values constitute the number of undetected attack sequences. This means that these attack sequences belong to the normal behavior (of the 833 TDM sequences). In this case, attack sequences may be identical to normal data sequences, and the model could not detect them. Instead, we use the occasion to highlight that if we eliminate these sequences from the ADM, the model becomes very efficient.

The most important thing to notice in this work is that all the described similarity measures give almost similar performances with different running times. This is due to how the presence of an attack is tested and, more precisely, how the threshold is defined. This is described in the BSA algorithm of this model.

To evaluate the proposed model, it is imperative to test it with other models which fall in the same field. From Table 12, all these models use ADFA-LD as a benchmark. We notice that BSA-HIDS (Jaro–Winkler) and BSA-HIDS (Levenshtein) give a high performance than that in studies [3,4] in terms of accuracy and false alarm rate, 94% accuracy, 5% FAR and 99% accuracy, 2% FAR using just 720 and 3,300 s, respectively. The result achieved by Marteau [3] was 90% accuracy in 900 seconds, and those achieved by Yaqoob and Madkour [4] were 90% accuracy and 22% FAR in seconds, but the number of seconds is unclear.

The proposed model has been developed aiming to have a performant HIDS, which is achieved and displayed in Table 12. The obtained results of the proposed system, BSA-HIDS, are superior to all up-to-date published systems in terms of accuracy, false alarm rate, and detection time. Although this model produced encouraging results, it does have limitations. The model cannot detect attack sequences that are an exact sequence of normal sequences.