<![CDATA[Host-based intrusion detection systems (HIDS) and endpoint detection and response platforms increasingly rely on high-volume host telemetry such as system-call and API-call sequences. Accurate trace classification is useful, but operational response also requires localization of the suspicious fragment and a readable evidence narrative. This paper presents an analyst-oriented HIDS workflow with three stages: window-based detection using 3-gram logistic regression, 1D CNN, BiLSTM with attention pooling, and Transformer encoder models; suspicious-window localization using maximum-probability window selection and attention attribution; and evidence-grounded forensic narrative generation from the same localized evidence. The main ADFA-LD evaluation uses 1,263 training traces and 316 test traces; the best detector, 3-gram logistic regression with W=100, achieves precision 0.958, recall 0.913, F1 0.935, and AUROC 0.980. To address dataset-size and cross-telemetry concerns, this study adds two bounded additional evaluations: an eight-family Windows API-call sequence experiment on Mal-API-2019 and a large NetFlow stress test on NF-ToN-IoT-v3 with 10,000, 20,000, 50,000, and 100,000 training records. The NetFlow experiment shows that deep models become more stable as data volume increases, but the linear baseline remains strongest at 100,000 records (F1=0.888), while the Transformer improves to F1=0.856. These results support a careful conclusion: larger datasets help deep models, but they do not automatically make a Transformer outperform a strong shallow baseline when the signal is dominated by compact local motifs or well-separated tabular flow features.]]>
Copyrights © 2026
