# systic

**Repository Path**: wingter/systic

## Basic Information

- **Project Name**: systic
- **Description**: Call Sequence-based intrusion detection base on Temporal semantic mining and Imbalance Classification (SysTIC)
- **Primary Language**: Python
- **License**: Apache-2.0
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 1
- **Forks**: 0
- **Created**: 2025-09-28
- **Last Updated**: 2026-04-14

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README



# Systic

Call Sequence-based Intrusion Detection based on Temporal Semantic Mining and Imbalance Classification (SysTIC)

## About

SysTIC is an advanced intrusion detection system that leverages system call sequences for security analysis. The approach treats system call sequences as "sentences" and applies natural language processing techniques to detect intrusions.

### Key Innovation

Certain semantics emerge when call sequences are perceived with a dynamic N-gram model. SysTIC proposes to pre-process and analyze system call sequences just like reading sentences. To leverage both temporal and semantic information for intrusion detection:

1. **Adaptive Subsequence Extraction**: An entropy and mutual information-based scheme that reduces sample redundancy and enhances internal correlation within each subsequence.

2. **Temporal Semantic Encoding**: An ensemble of CBoW-Gram model, LSTM, and attention mechanism to effectively capture intrinsic patterns in call sequences.

3. **One-vs-One (OvO) Classification**: Handles high complexity in multi-classification over imbalanced data.

## Modular Overview

SysTIC consists of the following core modules:

| Module | Description |
|--------|-------------|
| `MCN-Gram.py` | Multi-scale Conditional N-Gram extractor for subsequence extraction |
| `Cbow.py` | Continuous Bag of Words (CBOW) model with n-gram implementation |
| `LSTM.py` | LSTM with Attention mechanism for sequence modeling |
| `Classifier.py` | OvO (One-vs-One) classification for multi-class intrusion detection |
| `Load_data.py` | Data preprocessing, normalization, and mutual information calculation |
| `ROC.py` | Model evaluation and ROC curve plotting |

## Installation

### Requirements

- Python 3.x
- PyTorch
- NumPy
- Pandas
- Scikit-learn
- Matplotlib

Install dependencies:

```bash
pip install -r requirements.txt
```

## Usage

### Data Preprocessing

Use `Load_data.py` to preprocess system call data:

```bash
python scr/Load_data.py
```

### Feature Extraction

Extract multi-scale conditional n-gram features:

```bash
python scr/MCN-Gram.py
```

### Model Training

Train the CBOW embedding model:

```bash
python scr/Cbow.py
```

Train the LSTM classifier with attention:

```bash
python scr/LSTM.py
```

### Evaluation

Generate ROC curves for model evaluation:

```bash
python scr/ROC.py
```

## Experiment Results

### Multi-class Detection Performance

The system achieves robust performance in system call detection with one-vs-one classification.

### Binary Classification

ROC curves demonstrate superior detection capabilities compared to baseline methods.

## Project Structure

```
systic/
├── imgs/              # Documentation images
│   ├── overview.jpg   # System overview
│   ├── res1.jpg       # Detection results
│   └── res2.jpg       # ROC curves
├── scr/               # Source code
│   ├── Cbow.py        # CBOW model
│   ├── Classifier.py  # Classification module
│   ├── Load_data.py   # Data loading
│   ├── LSTM.py        # LSTM model
│   ├── MCN-Gram.py    # N-gram extraction
│   └── ROC.py         # Evaluation
├── requirements.txt   # Dependencies
└── README.md          # This file
```

## License

See LICENSE file for details.

## References

This project implements techniques from temporal semantic mining and imbalance classification research for intrusion detection applications.