In a contemporary data center, Linux applications often generate a large quantity of real-time
system call traces, which are not suitable for traditional host-based intrusion detection …

Advanced Persistent Threats (APTs) are difficult to detect due to their" low-and-slow" attack
patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based …

Abstract Host-based Intrusion Detection System (HIDS) is an effective last line of defense for
defending against cyber security attacks after perimeter defenses (eg, Network-based …

Due to the widespread diffusion of network connectivity, the demand for network security
and protection against cyber-attacks is ever increasing. Intrusion detection systems (IDS) …

To subvert recent advances in perimeter and host security, the attacker community has
developed and employed various attack vectors to make a malware much stealthier than …

Advanced cyber attacks consist of multiple stages aimed at being stealthy and elusive. Such
attack patterns leave their footprints spatio-temporally dispersed across many different logs …

Recently, malware has increasingly become a critical threat to embedded systems, while the
conventional software solutions, such as antivirus and patches, have not been so successful …

Modern OSes provide a rich set of services to applications, primarily accessible via the
system call API, to support the ever growing functionality of contemporary software …

Context: Run-time detection of system anomalies at the host level remains a challenging
task. Existing techniques suffer from high rates of false alarms, hindering large-scale …

Ransomware, particularly crypto ransomware, has emerged as the go-to malware for threat
actors aiming to compromise data on Android devices as well as in general. In this paper …