A lightweight system call intrusion detection method for resource-constrained embedded platforms

Abstract System-call-based intrusion detection on resource-constrained embedded platforms must balance detection accuracy, deployment overhead, and online integration. This paper proposes a lightweight host-based intrusion detection method that combines a CNN-Transformer model, multidimensional robustness optimization, progressive model compression, and online detection on embedded hosts. Two one-dimensional convolution layers extract local system-call patterns, a Transformer encoder captures long-range dependencies, and attention pooling aggregates salient evidence for trajectory-level classification. Under a trajectory-level data-splitting protocol, controlled experiments are conducted on data augmentation, R-Drop regularization, attention/pooling mechanisms, and auxiliary objectives. A progressive compression pipeline is then applied, including architecture exploration, graph-wide channel masking with gradient-constrained fine-tuning, physical channel removal, and module-wise post-training quantization (PTQ). Experiments on the Australian Defence Force Academy Linux Dataset (ADFA-LD) show that the combined model achieves F1 scores of 0.941 ± 0.013 and 0.869 ± 0.021 on the balanced and imbalanced test sets, respectively, with false positive rates (FPRs) of 0.085 ± 0.048 and 0.026 ± 0.009. After physical channel removal at d = 28, the parameter count and floating-point operations (FLOPs) decrease to 60.76 k and 108.13 M, respectively. Partial module-wise PTQ further reduces the model size to 304.36 KB. An ARM64 prototype based on Quick Emulator (QEMU), the Linux audit daemon (auditd), Job-Tree aggregation, and sliding-window inference validates the end-to-end pipeline for system-call collection, inference, alerting, and data upload.