IEEE Consumer Electronics Magazine - September/October 2021 - 107

Table 1. Optimal n and AUC Values Obtained in the Experiments.
Experiment
1
Crossvalidation
Training-
validation
split
2
34567 89 10
Mode Average
AUC 0.990 0.967 0.986 0.977 0.967 0.986 0.979 0.981 0.986 0.981 N/A 0.980
n
4 44456 654 4
4
AUC 0.992 0.967 0.980 0.977 0.972 0.974 0.987 0.987 0.978 0.983 N/A 0.9797
n
6 46464 444 5
4
N/
A
N/
A
recorded data are shown in Table 1. The last two
columns show the modes of the optimal values of
n, and the average of the optimal AUC values
obtained from ten experiments. According to
Table 1, for the ADFA-LD dataset, when it comes to
the average optimal AUC values, the cross-validationmethod's
detection accuracy is slightly better
than the training-validation split method. Both
model selectionmethods choose 4-gram.
Two groups of experiments are carried out to
test the efficiency and scalability, corresponding
to two model selection methods. Scalability is
tested by adjusting the number of executors
(ranges from 1 to 6) in the Spark cluster. For
each group of experiments, the system executes
three times in each case of the number of executors.
During each execution, the executors' ATT
is recorded. The average value of three ATTs is
recorded in Figure 4. Figure 4 shows the relationship
between the ATT of executors and the number
of executors. As per Figure 4, the crossvalidation
method needs more computation time
than the training-validation split method. The
training-validation split method only evaluates
the parameter set once, so it needs less computing
resources. However, when the dataset for
training is small, the result of training-validation
split may be inaccurate. For both of the two
model selection methods, with the number of
executors increasing, the ATTs of executors
decrease significantly. Therefore, the proposed
framework shows good scalability. The proposed
framework can efficiently and automatically
select the length of system call sequences, which
is essential for HIDS. The entire execution time of
each model selection method is less than 200 s.
Therefore, the proposed framework is more
time-efficient whist keeps a similar detection
accuracy than other HIDS methods such as in
the work by Creech and Hu.10
CONCLUSION AND FUTURE WORK
In this article, a two-tier scalable HIDS framework
is designed for embedded systems. The
framework is based on Spark and is deployed in
the public cloud environment, using the Pipeline
and the model selection methods. The experiment
results on the ADFA-LD dataset indicate
that the framework proposed in this article can
automatically select parameters to reduce the
latency and improve the scalability of HIDS.
Future work will focus on adjusting the system
to achieve higher detection efficiency and accuracy,
and utilizing real-time streaming data from
embedded devices for experiments.
&REFERENCES
Figure 4. Scalability of the proposed framework.
September/October 2021
1. S. P. Mohanty, V. P. Yanambaka, E. Kougianos, and
D. Puthal, " PUFchain: A hardware-assisted blockchain
for sustainable simultaneous device and data security
in the Internet of Everything (IoE), " IEEEConsum.
Electron. Mag., vol. 9, no. 2, pp. 8-16, Mar. 2020.
107
IEEE Consumer Electronics Magazine - September/October 2021

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - September/October 2021
