A HYBRID MODEL FOR POST-INTRUSION BEHAVIOR DETECTION IN LINUX-BASED NETWORK OPERATING SYSTEMS AND COMPARATIVE EVALUATION OF MACHINE-LEARNING COMPONENTS: A CASE STUDY ON SONIC

In Linux-based network operating systems, post-intrusion activity appears in process and container behaviour. A host detection model is formalised with primary system-call filtering in kernel space and, in user space, windowed behavioural features, a rule layer, and a machine-learning layer with a decision function. Methods for windowed feature construction and an evaluation protocol with session-held-out splits and leave-one-technique-out testing are specified. As instantiations of the learning layer on open SONiC, gradient boosting, an autoencoder, a bidirectional LSTM denoted BiLSTM, and a weighted score ensemble are considered; the comparative study includes an ablation of ensemble branches. Comparative results show that BiLSTM achieves the highest harmonic mean of precision and recall; the weighted score ensemble underperforms the single BiLSTM, and fusion quality is dominated by the gradient-boosting branch. Validation was performed on a virtualised stand without a dedicated neural-network accelerator.