{"id":"https://openalex.org/W7225826730","doi":"https://doi.org/10.23939/csn2026.02.080","title":"A HYBRID MODEL FOR POST-INTRUSION BEHAVIOR DETECTION IN LINUX-BASED NETWORK OPERATING SYSTEMS AND COMPARATIVE EVALUATION OF MACHINE-LEARNING COMPONENTS: A CASE STUDY ON SONIC","display_name":"A HYBRID MODEL FOR POST-INTRUSION BEHAVIOR DETECTION IN LINUX-BASED NETWORK OPERATING SYSTEMS AND COMPARATIVE EVALUATION OF MACHINE-LEARNING COMPONENTS: A CASE STUDY ON SONIC","publication_year":2026,"publication_date":"2026-11-11","ids":{"openalex":"https://openalex.org/W7225826730","doi":"https://doi.org/10.23939/csn2026.02.080"},"language":"en","primary_location":{"id":"doi:10.23939/csn2026.02.080","doi":"https://doi.org/10.23939/csn2026.02.080","is_oa":true,"landing_page_url":"https://doi.org/10.23939/csn2026.02.080","pdf_url":null,"source":{"id":"https://openalex.org/S4210238343","display_name":"Komp'\u00fbtern\u00ec sistemi ta mere\u017e\u00ec","issn_l":"2707-2371","issn":["2707-2371"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer systems and network","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.23939/csn2026.02.080","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5031493332","display_name":"\u0410. \u0420. \u0414\u043e\u0431\u0443\u0448","orcid":"https://orcid.org/0009-0000-8336-1407","observed_orcids":["https://orcid.org/0009-0000-8336-1407"]},"institutions":[{"id":"https://openalex.org/I98435010","display_name":"Lviv Polytechnic National University","ror":"https://ror.org/0542q3127","country_code":"UA","type":"education","lineage":["https://openalex.org/I98435010"]}],"countries":["UA"],"is_corresponding":false,"raw_author_name":"A. R. Dobush","raw_affiliation_strings":["Lviv Polytechnic National University"],"raw_orcid":"https://orcid.org/0009-0000-8336-1407","affiliations":[{"raw_affiliation_string":"Lviv Polytechnic National University","institution_ids":["https://openalex.org/I98435010"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077166238","display_name":"Bohdan Havano","orcid":"https://orcid.org/0000-0002-2546-1917","observed_orcids":["https://orcid.org/0000-0002-2546-1917"]},"institutions":[{"id":"https://openalex.org/I98435010","display_name":"Lviv Polytechnic National University","ror":"https://ror.org/0542q3127","country_code":"UA","type":"education","lineage":["https://openalex.org/I98435010"]}],"countries":["UA"],"is_corresponding":false,"raw_author_name":"B. I. Havano","raw_affiliation_strings":["Lviv Polytechnic National University"],"raw_orcid":"https://orcid.org/0000-0002-2546-1917","affiliations":[{"raw_affiliation_string":"Lviv Polytechnic National University","institution_ids":["https://openalex.org/I98435010"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I98435010"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"8","issue":"2","first_page":"80","last_page":"87"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0012000000569969416,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.6636000275611877},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6626999974250793},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5478000044822693},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5203999876976013},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4961000084877014},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.49149999022483826},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.47760000824928284},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.4675000011920929},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.4643999934196472},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.4510999917984009},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.42590001225471497},{"id":"https://openalex.org/C2781018962","wikidata":"https://www.wikidata.org/wiki/Q5164884","display_name":"Container (type theory)","level":2,"score":0.4226999878883362},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.41749998927116394},{"id":"https://openalex.org/C119898033","wikidata":"https://www.wikidata.org/wiki/Q3433888","display_name":"Ensemble forecasting","level":2,"score":0.40849998593330383},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.36160001158714294},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.33869999647140503},{"id":"https://openalex.org/C2778751112","wikidata":"https://www.wikidata.org/wiki/Q835016","display_name":"Window (computing)","level":2,"score":0.33230000734329224},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C71134354","wikidata":"https://www.wikidata.org/wiki/Q458825","display_name":"Kernel density estimation","level":3,"score":0.3190000057220459},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.31220000982284546},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.3109999895095825},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.3068999946117401},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3012999892234802},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2842999994754791},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2718999981880188},{"id":"https://openalex.org/C107327155","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision support system","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23939/csn2026.02.080","doi":"https://doi.org/10.23939/csn2026.02.080","is_oa":true,"landing_page_url":"https://doi.org/10.23939/csn2026.02.080","pdf_url":null,"source":{"id":"https://openalex.org/S4210238343","display_name":"Komp'\u00fbtern\u00ec sistemi ta mere\u017e\u00ec","issn_l":"2707-2371","issn":["2707-2371"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer systems and network","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.23939/csn2026.02.080","doi":"https://doi.org/10.23939/csn2026.02.080","is_oa":true,"landing_page_url":"https://doi.org/10.23939/csn2026.02.080","pdf_url":null,"source":{"id":"https://openalex.org/S4210238343","display_name":"Komp'\u00fbtern\u00ec sistemi ta mere\u017e\u00ec","issn_l":"2707-2371","issn":["2707-2371"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computer systems and network","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1985987493","https://openalex.org/W2156204309","https://openalex.org/W2551087083","https://openalex.org/W2808779485","https://openalex.org/W2900713154","https://openalex.org/W2983800303","https://openalex.org/W3136767761","https://openalex.org/W4399662230","https://openalex.org/W4411231648","https://openalex.org/W7123652171","https://openalex.org/W7161408527","https://openalex.org/W7212171364"],"related_works":[],"abstract_inverted_index":{"In":[0],"Linux-based":[1],"network":[2],"operating":[3],"systems,":[4],"post-intrusion":[5],"activity":[6],"appears":[7],"in":[8,23,27],"process":[9],"and":[10,36,49,56,79,107,117],"container":[11],"behaviour.":[12],"A":[13],"host":[14],"detection":[15],"model":[16],"is":[17,120],"formalised":[18],"with":[19,40,53],"primary":[20],"system-call":[21],"filtering":[22],"kernel":[24],"space":[25],"and,":[26],"user":[28],"space,":[29],"windowed":[30,46],"behavioural":[31],"features,":[32],"a":[33,37,41,74,80,130,134],"rule":[34],"layer,":[35],"machine-learning":[38],"layer":[39,66],"decision":[42],"function.":[43],"Methods":[44],"for":[45],"feature":[47],"construction":[48],"an":[50,72,90],"evaluation":[51],"protocol":[52],"session-held-out":[54],"splits":[55],"leave-one-technique-out":[57],"testing":[58],"are":[59,84],"specified.":[60],"As":[61],"instantiations":[62],"of":[63,92,105],"the":[64,86,101,109,114,123],"learning":[65],"on":[67,129],"open":[68],"SONiC,":[69],"gradient":[70],"boosting,":[71],"autoencoder,":[73],"bidirectional":[75],"LSTM":[76],"denoted":[77],"BiLSTM,":[78,116],"weighted":[81,110],"score":[82,111],"ensemble":[83,93,112],"considered;":[85],"comparative":[87],"study":[88],"includes":[89],"ablation":[91],"branches.":[94],"Comparative":[95],"results":[96],"show":[97],"that":[98],"BiLSTM":[99],"achieves":[100],"highest":[102],"harmonic":[103],"mean":[104],"precision":[106],"recall;":[108],"underperforms":[113],"single":[115],"fusion":[118],"quality":[119],"dominated":[121],"by":[122],"gradient-boosting":[124],"branch.":[125],"Validation":[126],"was":[127],"performed":[128],"virtualised":[131],"stand":[132],"without":[133],"dedicated":[135],"neural-network":[136],"accelerator.":[137]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-11-12T00:00:00"}