From CVE to CWE: Syscall-Based HIDS Generalisation

Research Question and Approach

This paper investigates whether host intrusion detection systems (HIDS) can be generalized to detect new exploits of a known weakness class (CWE) rather than being limited to individual CVE instances. The authors test the hypothesis that a one-class anomaly detector, trained on the combined normal behavior of multiple CVEs within the same CWE family, can effectively identify unseen exploits of that same class.

The study utilizes six scenarios from the LID-DS-2021 dataset, grouped into three CWE categories: CWE-307 (broken authentication), CWE-89 (SQL injection), and CWE-434 (unrestricted file upload). The researchers extract 66-dimensional feature vectors per sliding window and employ Isolation Forest and SGD One-Class SVM models. A critical methodological contribution is the use of a normal-only calibration protocol, which sets detection thresholds at fixed target false positive rates (FPR) without exposure to exploit labels, ensuring a more realistic and honest evaluation of detector performance.

Key Findings

The empirical results reveal a stark contrast between CWE families. The combined CWE-307 detector achieved an F1 score of 0.6976 at a 5% target FPR, demonstrating successful generalization. In contrast, detectors for CWE-89 and CWE-434 performed poorly, with F1 scores remaining at or below 0.21.

The authors found that cross-CVE transfer is highly asymmetric. A model trained on a broad normal profile (e.g., brute-force attempts) can successfully detect exploits in a narrower scenario, but the reverse is not true; applying a model trained on a narrow normal profile to a broader scenario leads to a collapse in precision due to excessive false positives. Ultimately, the study concludes that while CWE-level generalization is possible, it is not universal and is heavily dependent on the diversity of the source normal profile.

In operational security environments, the volume of new CVEs often outpaces the ability to retrain and maintain individual HIDS models. By shifting the focus from CVE-specific detection to CWE-level generalization, defenders can create more robust and scalable systems that address the underlying vulnerability type. This research provides a rigorous methodological framework for evaluating such systems, emphasizing the necessity of calibrated FPR reporting to avoid misleading performance metrics.