Natural Language Processing & Anomaly detection in Sys call logs

Abstract

Containers (lightweight application virtualization) provide further isolation for application's, but the container daemon and management systems, ads more attack surface. The research problem is that despite segmentation and system call hardening, containers are still vulnerable and the host and other containers can be affected. In this paper, the use of syscall (system calls, calls to kernel) logging in Linux x86_64 systems is investigated with Natural Language Processing. Logs are tokenized and hashed, then transformed into a sparse matrix encoding. The purpose of the method is to classify the documents and test the different accuracies of different classifiers, such as Random Forest, K Nearest Neighbor, etc.