A Resource-Aware Behavior Reconstruction and Hierarchical Semantic Learning Framework for Host Intrusion Detection
ReSHID reconstructs fragmented system call sequences by organizing them around specific objects and using resource tracking to link related operations across different tasks. It then uses a hierarchical learning approach, including Graph Attention Networks, to model how different processes coordinate their actions. This method significantly improves host intrusion detection accuracy.