Two-layer Intrusions Detection Model Based on System Calls and Network Raw Data

For each single detection measure or model, there are undetectable intrusion types. To overcome this drawback of single-measure anomaly detector, the two-layer intrusion detection model is provided . This kind of intrusion detection model combined the network intrusion detection and system call based intrusion detection technology to detect both known intrusion and novel intrusion. The results show that the two-layer intrusion detection model is more effective and robust.