## 5 Experiment
### Anomaly-Detection Classification Model
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**U-SCAD**} & \multicolumn{3}{c}{**HIDS**} & \multicolumn{3}{c}{**LSTM-VAE**} \\ \cline{2-10}  & **P** & **R** & **F1** & **P** & **R** & **F1** & **P** & **R** & **F1** \\ \hline CVE\_2022\_22965 & 0.856 & 0.999 & 0.922 & 0.861 & 0.900 & 0.880 & 0.543 & 0.768 & 0.636 \\ CVE\_2022\_22947 & 0.978 & 0.991 & 0.989 & 0.627 & 0.181 & 0.281 & 0.348 & 0.884 & 0.499 \\ CVE\_2022\_0543 & 0.845 & 0.998 & 0.913 & 0.761 & 1.000 & 0.864 & 0.308 & 0.723 & 0.432 \\ CVE\_2020\_1938 & 0.990 & 0.992 & 0.995 & 0.941 & 1.000 & 0.970 & 0.738 & 0.945 & 0.829 \\ CVE\_2012\_2122 & 0.897 & 0.998 & 0.945 & 0.735 & 0.510 & 0.602 & 0.543 & 0.768 & 0.636 \\ Docker\_sock & 0.953 & 0.973 & 0.963 & 0.932 & 0.990 & 0.960 & 0.704 & 0.954 & 0.810 \\ Kubeconfig & 0.987 & 0.990 & 0.988 & 0.805 & 0.890 & 0.845 & 0.588 & 0.883 & 0.706 \\ Host\_mount & 0.988 & 0.988 & 0.981 & 0.914 & 0.980 & 0.946 & 0.820 & 0.979 & 0.892 \\ redis\_unacc & 0.804 & 0.982 & 0.884 & 0.431 & 0.500 & 0.463 & 0.308 & 0.723 & 0.432 \\ mysql\_unacc & 0.847 & 0.872 & 0.859 & 0.797 & 0.820 & 0.808 & 0.741 & 0.887 & 0.807 \\ \hline
**Avg.** & **0.915** & **0.978** & **0.944** & **0.780** & **0.777** & **0.762** & **0.564** & **0.851** & **0.668** \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Anomaly classification results in KAS-DS. Figure 8: F1 scores of models’ anomaly detections in KAS-DS  
Figure 9: CVE_2012_2122 anomaly scores, w/params versus w/o params. \begin{table}
\begin{tabular}{c c c c c c c} \hline \multirow{2}{*}{**Model**} & \multicolumn{3}{c}{**U-SCAD**} & \multicolumn{3}{c}{**HIDS**} \\ \cline{2-7}  & **P** & **R** & **F1** & **P** & **R** & **F1** \\ \hline CVE\_2016\_9962 & 0.977 & 0.990 & 0.983 & 0.997 & 0.996 & 0.997 \\ M-Socket & 0.989 & 0.994 & 0.991 & 0.997 & 0.994 & 0.996 \\ CVE\_2019\_5736 & 0.995 & 1.000 & 0.997 & 0.997 & 0.991 & 0.994 \\ CVE\_2022\_0492 & 0.988 & 1.000 & 0.994 & 0.997 & 0.991 & 0.994 \\ CVE\_2022\_0847 & 0.993 & 0.996 & 0.994 & 0.997 & 0.989 & 0.993 \\ M-SYS\_MOD & 0.990 & 0.988 & 0.989 & 0.997 & 0.999 & 0.998 \\ M-SYS\_ADMIN & 0.987 & 0.995 & 0.991 & 0.997 & 0.996 & 0.997 \\ M-MKNOD & 0.994 & 0.990 & 0.992 & 0.997 & 0.994 & 0.996 \\ M-NET & 0.984 & 0.995 & 0.989 & 0.997 & 0.991 & 0.994 \\ M-U\_HELPER & 0.993 & 0.992 & 0.992 & 0.997 & 0.998 & 0.998 \\ \hline
**Avg.** & **0.989** & **0.994** & **0.991** & **0.997** & **0.994** & **0.995** \\ \hline \end{tabular}
\end{table} 
Table 8: Anomaly classification results in CB-DS. The Figure 9 depicted the effect of our anomaly-detection method in CVE_2012_2122. The plot above shows the anomaly score of each timestamp generated by the classification model. In addition, the plot below shows the time when the exploits start. As we can see, the anomaly score increases when the exploit starts. The left image shows anomaly scores using parameter information, while the right one depicts the scenario where only system call types are used as features. From the images, it is evident that utilizing parameter information enables the anomaly-detection method to yield higher anomaly scores effectively when anomalies occur, distinguishing them from normal behavior. On the contrary, without parameter information, it is not possible to effectively differentiate between normal and anomalous behavior. As shown in Figure 10, for the CVE_2022_2947 scenario, although without using parameters, there is some ability to distinguish between normal and anomalous behavior to some extent, when parameters are used, the anomaly scores for normal behavior are significantly lower, and the difference in anomaly scores between normal and anomalous behavior becomes more apparent. Figure 11 displays the ROC curves for the three types of scenarios: application CVE exploits, misconfiguration exploits, and direct access. As we can see in the figure, all the AUCs of these scenarios reached 0.98 or above.