A Hybrid Model for Post-intrusion Behavior Detection in Linux-based Network Operating Systems and Comparative Evaluation of Machine-learning Components: a Case Study on Sonic
Year: 2026
Type: article
Abstract: In Linux-based network operating systems, post-intrusion activity appears in process and container behaviour. A host detection model is formalised with primary system-call filtering in kernel space and, in user space, windowed behavioural features, a rule layer, and a machine-learning layer with a decision function. Methods for windowed feature construction and an evaluation protocol with session-held-out splits and leave-one-technique-out testing are specified. As instantiations of the learning layer on open SONiC, gradient boosting, an autoencoder, a bidirectional LSTM denoted BiLSTM, and a weighted score ensemble are considered; the comparative study includes an ablation of ensemble branches. Comparative results show that BiLSTM achieves the highest harmonic mean of precision and recall; the weighted score ensemble underperforms the single BiLSTM, and fusion quality is dominated by the gradient-boosting branch. Validation was performed on a virtualised stand without a dedicated neural-network accelerator.
Source: Komp'ûternì sistemi ta merežì
Authors: A. R. Dobush, B. I. Havano
Institution: Lviv Polytechnic National University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7225826730