# A Study on Detection of Malicious Behavior Based on Host Process Data Using Machine Learning
## 2 Related Works
### Machine Learning Algorithms  
As investigated in Section 2.1, various algorithms have been employed for anomaly detection in related works. In this experiment, we selected KNN, NB, RF, Autoencoder (AE) [42], and Memory-augmented Deep Autoencoder (MemAE) [43] as our machine learning algorithms, based on their performance and suitability for the task.  
The reasons for selecting these specific algorithms are as follows:  
1. KNN: KNN is a simple and effective algorithm that has been used in many cyber-attack detection studies, including [PERSON], [PERSON], et al. [10], [PERSON], [PERSON] [25], and [PERSON], [PERSON], et al. [35]. Its non-parametric nature and ease of implementation make it a popular choice for anomaly detection tasks.
2. NB: Naive Bayes is a probabilistic classifier that has been employed in various cyber-attack detection research, such as [PERSON], [PERSON] [25]. It is computationally efficient and performs well with discrete data, making it a suitable choice for our study.
3. RF: Random Forest is an ensemble learning method that has demonstrated high performance in multiple cyber-attack detection studies, including [PERSON], [PERSON], et al. [10], [PERSON], [PERSON] [25] and [PERSON], [PERSON], et al. [41]. Its ability to handle large datasets and perform feature selection makes it a relevant choice for our experiment.
4. AE: Autoencoders are unsupervised learning models that have been used in anomaly detection tasks due to their ability to learn useful representations of data. In this study, we chose AE for its potential to capture complex patterns in the application process data.
5. MemAE: Memory-augmented Deep Autoencoder is a deep learning model that incorporates memory mechanisms to enhance the representation learning capabilities of autoencoders. MemAE was selected for this study as it has demonstrated promising performance in detecting anomalies, particularly in complex and high-dimensional data.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Study** & **Data** & **Detection Technique** & **Limitations** \\ \hline [PERSON], [PERSON], et al. [10] & Host (System calls,...) [11; 12; 13; 14; 15; 16; 17; 18; 19] & J48 [19], RF [20], LMT [21], KNN [22] & No analysis of false positives/negatives \\ \hline [PERSON], [PERSON], et al. [23] & IDS Data, Host (System calls,...) [23] & IDS Data, Host (System calls,...) [23] & ART [24] & Limited to online anomaly detection \\ \hline [PERSON] [25] & UNSW-NB15 [26], NSL-KDD [27] & RF [20], KNN [22], NB [28], LDA [29], XGBoost [30], SVM [31], AdaBoost [32], SGD [33], LR [34] & No evaluation on real-world attacks \\ \hline [PERSON], et al. [35] & CTU-13 [36] & KNN [22], SVM [31], MLP [37] & Limited to botnet command and control server detection \\ \hline [PERSON], et al. [38] & Host (System calls,...) [13] & SVM [31], LR [34], MLP [37], MatchGNet [38], GCN [39] & No analysis of false positives/negatives \\ \hline [PERSON], [PERSON], et al. [40] & Host (System calls,...) [40] & Graph-based [40] & Limited evaluation on real-world data \\ \hline [PERSON], et al. [41] & Host (server, app,...) [41] & RF [20] & Limited data collection, algorithm validation, and visualization methods \\ \hline \hline \end{tabular}
\end{table}
Table 1: Behavior-based data and detection methods in related works.