From CVE to CWE: Syscall-Based HIDS Generalisation Alexander V. Kozachok1 ⋆ , Stanislav G. Vyugov2 , and Shamil G. Magomedov1 1
arXiv:2606.22581v1 [cs.CR] 21 Jun 2026
MIREA – Russian Technological University, Moscow, Russian Federation {kozachok_a, magomedov_sh}@mirea.ru 2 Academy of the Federal Guard Service of the Russian Federation, Oryol, Russian Federation [email protected]
Abstract. Host intrusion detection systems (HIDS) based on systemcall traces are typically trained and evaluated against individual Common Vulnerabilities and Exposures (CVE) instances. In operational settings, however, defenders need to recognise new exploits of an already known type of weakness. We empirically examine whether a one-class anomaly detector trained on the normal behaviour of a set of CVEs that share a Common Weakness Enumeration (CWE) class generalises to a different, unseen CVE inside the same class. Using six scenarios drawn from LID-DS-2021 and grouped into three CWE families (CWE-307 broken authentication, CWE-89 SQL injection, CWE-434 unrestricted file upload), we extract a 66-dimensional Peng-Guo-style feature vector per sliding window and train Isolation Forest and SGD One-Class SVM detectors with normal-only thresholds calibrated to fixed target false positive rates. We define and answer four research questions covering self-detection, asymmetric cross-CVE transfer, the value of a combined CWE-level normal profile, and the effect of feature filtering on transferability. The combined CWE-307 detector reaches F1 = 0.6976 at calibration target FPR = 0.05 (precision = 0.8994, recall = 0.5698), whereas CWE-89 and CWE-434 collapse to F1 ≤ 0.21 under the same protocol. Cross-CVE transfer turns out to be strongly direction-dependent and dominated by the breadth of the source normal profile rather than by the CWE label. We conclude that CWE-level generalisation in HIDS is empirically attainable for some but not all weakness families with current syscall features, and we argue that calibrated FPR is a methodological prerequisite for honest reporting in this setting. Keywords: host intrusion detection, system calls, anomaly detection, Common Weakness Enumeration, one-class learning, calibration, container security, LID-DS-2021 ⋆
Corresponding author
2
Kozachok, Vyugov, Magomedov
1
Introduction
Host intrusion detection on Linux containers is dominated by approaches that treat each known vulnerability as a separate detection target. Forrest’s seminal work on short system-call sequences [1] opened a long line of classifiers that, in modern form, learn one model per scenario or application [3,6,7,8]. In practice, however, two operational realities push back against this design. First, the flow of new CVE entries [30] is faster than the rate at which production models can be re-trained [28,29]. Second, security operations analysts seldom need to know which exact CVE has been exploited; they need to know which class of weakness was triggered, because the appropriate mitigation – input sanitisation, file-upload validation, throttling of authentication attempts – is determined by the Common Weakness Enumeration (CWE) class rather than by the CVE identifier. This paper studies whether the runtime behaviour of containerised applications exposes CWE-level invariants in system-call traces that are strong enough to support a single detector covering several CVEs of the same class. This question is motivated by an empirical observation in SecQuant [18]: distinct CVEs that share a defect type tend to produce visually identical risk weight vectors over syscalls. The authors used this observation to quantify exposure; they did not build a detector. Closely related work from NCSU [14,15,16,17] groups exploits by their impact (e.g. “arbitrary code execution”, “credential disclosure”), not by the CWE class of the underlying defect. We frame the problem as one-class anomaly detection on per-window features adapted from Peng Guo’s HIDS pipeline [11], then ask how the resulting models behave under cross-CVE and combined CWE protocols. Crucially, thresholds are not chosen on labelled exploit data; they are calibrated on a normal-only validation split at fixed target false positive rates [10,9,26]. This calibration makes direction-dependent transfer effects visible that are otherwise hidden by labeltuned thresholds. The contributions of this paper are: – An evaluation protocol for CWE-level HIDS in which threshold selection is decoupled from exploit labels and the realised FPR is reported alongside precision, recall, and F1. – Empirical evidence on three CWE families (CWE-307, CWE-89, CWE434) and six scenarios (Section 5) showing that cross-CVE transferability is strongly asymmetric and is dominated by the breadth of the source normal profile rather than by the shared CWE label. – Quantitative results on feature filtering that contradict the intuition “select stable features for better transfer”: the most aggressive normal-domain stability filters destroy the strongest transfer direction we observe. – Three pseudocode algorithms (Sections 4-5) that fully specify the calibrated detection, cross-CVE transfer and feature-selection procedures used in the study.
From CVE to CWE: Syscall-Based HIDS Generalisation
3
The remainder of the paper is organised as follows. Section 2 surveys the related literature. Section 3 states the hypothesis and the research questions. Section 4 describes the dataset, the feature representation, the one-class models and the calibration protocol. Section 5 reports the experimental results. Section 6 discusses why CWE-307 generalises well while CWE-89 and CWE-434 do not, and Section 7 concludes.
2
Related Work
Syscall-based HIDS. System-call sequences as a behavioural signal go back to STIDE [1,2] and have evolved through n-gram and language models [3,4] to semantic and graph-based representations [6,5]. The LID-DS-2019 and LID-DS2021 datasets [7,8] standardised the evaluation of HIDS on containerised applications and are the empirical basis of the present paper. Peng Guo’s recent work [11] enriches sequence features with argument, return-value and resource statistics, which we adopt as our feature backbone. Khairi et al. [12] (CHIDS) and Sommer and Paxson’s classic critique [13] frame the methodological pitfalls we try to avoid: hidden label leakage and threshold tuning on test data. Container exploit detection. The NCSU series [14,15,16,17] classifies container exploits by impact category. CDL [15] clusters applications by normal behaviour, SHIL [16] adds self-supervised hybrid learning, and the latest framework [17] reaches 46 CVEs. None of these works groups exploits by CWE; this paper contributes exactly that grouping for runtime detection. Static and textual CVE-to-CWE mapping. ThreatZoom [19], V2W-BERT [20], TREE-VUL [21] and VulANalyzeR [22] predict CWE from text, patches or binaries. Atiiq et al. [23] show that CWE-specialised classifiers outperform a single binary classifier. These works confirm the relevance of the CWE granularity but operate at design time, not runtime. Anomaly detection methodology. Isolation Forest [9] and one-class SVM [10] are the two model families we use. Calibration of thresholds at a fixed false positive rate has long been standard in biometric and intrusion-detection work [26,27]. Hierarchical classification of network intrusions [24], multi-channel contrastive learning [31], and prototype-based contrastive learning [25] provide methodological templates for future CWE-aware models, but none has been applied to container syscall traces with CWE labels. The choice and reporting of binaryclassification metrics in such work follows the conventions reviewed by Canbek et al. [32]. Position of this work. Compared with [17], we classify by cause (CWE), not by impact; compared with [19,21,22], we operate on runtime traces, not on source or binaries; compared with [11], we reuse the feature space but pose a different evaluation question – does the same feature space transport across CVEs of a shared CWE class?
4
3
Kozachok, Vyugov, Magomedov
Problem Formulation and Hypothesis
Let T be a sliding-window syscall trace of a containerised application and let φ : T → Rd be a feature extractor. Let C be a CWE class and {v1 , . . . , vk } ⊂ C a set of CVEs that share class C. A CWE-level detector for class C is a function hC : Rd → {0, 1} trained from traces of an arbitrary subset V ⊂ C such that, for any new CVE v ⋆ ∈ C \ V and any trace T ⋆ containing an exploit of v ⋆ , hC (φ(T ⋆ )) = 1 with high probability while the false positive rate on the normal behaviour of any application in C stays below a user-specified target α. This formulation makes two assumptions explicit. First, the detector is oneclass: it is trained on normal traces only. Second, the normal profile is itself a property of the application, not of the CWE, so a CWE-level detector must combine, or otherwise reconcile, several application-specific normals. Hypothesis. (Operational form.) If two CVEs va , vb ∈ C share the same CWE class, then a one-class detector trained on the union of normal windows from {va , vb } and applied to the union of test frames of {va , vb } achieves – at a calibrated false positive rate α ≤ 0.05 – a strictly better F1 than the best of the two per-scenario self-detectors evaluated at the same α, while keeping the realised FPR within an order of magnitude of α. The hypothesis is supported for C if both conditions hold; it is refuted if either fails (large realised FPR or no F1 gain over self-detection). This is a directly testable criterion that avoids the ambiguous “comparable to self-detection” wording: combined CWE-307 satisfies it (Section 5); CWE-89 and CWE-434 do not. Research questions. We decompose the hypothesis into four research questions. RQ1. Does normal-only training on a single CVE scenario yield a usable selfdetector at calibrated FPR? – This is the lower bound; without it, a CWElevel extension is hopeless. RQ2. Does an anomaly model trained on the normal profile of CVE va transfer to an unseen CVE vb of the same CWE class? Is the transfer symmetric? RQ3. Does pooling the normal profiles of {va , vb } into a single combined CWElevel detector outperform self- and cross-CVE detectors at a fixed target FPR? RQ4. Do feature filters that maximise normal-domain stability across {va , vb } improve cross-CVE transferability?
4
Methodology
4.1
Dataset and feature space
Table 1 summarises the six scenarios. They are drawn from LID-DS-2021 [8], which already ships with CWE-labelled scenario names, and grouped into three CWE classes.
From CVE to CWE: Syscall-Based HIDS Generalisation
5
Table 1: Per-scenario row counts after feature extraction. train normal contains only normal windows; test mixes normal and exploit windows. CWE
Scenario
CWE-307 Bruteforce_CWE-307 CWE-307 CVE-2012-2122 CWE-89 CWE-89-SQL-injection CWE-89 Juice-Shop CWE-434 EPS_CWE-434 CWE-434 PHP_CWE-434
train normal test normal test exploit features 26 857 29 473 30 741 26 135 26 820 30 703
103 278 112 723 115 279 34 936 37 628 114 328
4 528 233 425 9 599 3 777 1 530 4 296
66 66 66 66 66 66
The feature extractor φ produces a per-window 66-dimensional vector. Following Peng Guo [11] and the LID-DS-2021 reporting conventions [8], the window length is one second with a step of 300 ms. We intentionally do not vary these window parameters in this study: the aim is to isolate the CWE-level generalisation question from feature-engineering choices, so the window size is fixed to the value that the reference HIDS pipeline uses on LID-DS-2021. The sensitivity of cross-CVE transfer to the window size is a known open question and is deferred to future work. The 66 features fall in six groups: (i) unseen-argument and unseen-syscall influence (UAI, USI); (ii) counts of syscalls with negative return value; (iii) per-window syscall frequency (FI); (iv) maximum data-volume features for resource-related syscalls (SRF); (v) PID/TID statistics; and (vi) inter-event time-delta histograms. 4.2
Models and calibration
We use two one-class models that have orthogonal inductive biases. Isolation Forest [9] relies on random partitioning and is robust to scaling and high dimensionality. SGD One-Class SVM [10] approximates an RBF kernel via the random-features expansion of Rahimi and Recht [33] and is trained with stochastic gradient descent on the hinge-like one-class loss. Both models are paired with either StandardScaler or RobustScaler preprocessing, yielding six candidates per scenario. The calibration step turns anomaly scores into binary decisions without seeing labelled exploits. Algorithm 1 states the protocol; it is the central methodological device of this paper and is also the only protocol applied to the combined CWE detector (Section 4.4). For every scenario we run Algorithm 1 for each candidate at three target FPRs α ∈ {0.001, 0.01, 0.05} and report, for each α, the candidate with the largest F1 on the corresponding test frame. The choice of best candidate is therefore based on the test frame, but the threshold for that candidate is set by Algorithm 1 on the normal-only calibration split and never sees an exploit label. We note that this protocol still permits a mild form of selection bias for self-detection and the combined CWE detector, because architecture/scaler are picked on the same labelled test frame on which we report. The bias is bounded
6
Kozachok, Vyugov, Magomedov
Algorithm 1 Normal-only calibrated one-class detection Require: normal training frame Dn , mixed test frame Dt , candidate model M , target false positive rate α, RNG seed s Ensure: threshold τ , decision function h, metrics M 1: Dnfit , Dncal ← TrainTestSplit(Dn , 0.3, s) 2: Σ ← FitScaler(Dnfit ) 3: M ← FitModel Σ(Dnfit ), s 4: Sc ← AnomalyScores M, Σ(Dncal ) 5: τ ← Quantile(Sc , 1 − α) ▷ higher score = more anomalous 6: St ← AnomalyScores(M, Σ(Dt )) 7: ŷ ← [s ≥ τ : s ∈ St ] 8: M ← Metrics(ŷ, yt ) ▷ precision, recall, F1, realised FPR 9: return τ , h : x 7→ [AnomalyScore(M, Σ(x)) ≥ τ ], M
Algorithm 2 Cross-CVE transfer evaluation Require: source scenario s, target scenario t, target FPR α Ensure: transfer metrics Mt (s) (s) ▷ M ⋆ is the best candidate for s 1: τ, h, · ← Algorithm 1(Dn , Dt , M ⋆ , α) (t) (t) 2: y ← labels of Dt (t) 3: ŷ (t) ← h Dt 4: Mt ← Metrics(ŷ (t) , y (t) ) 5: return Mt
in the present setting – the candidate pool has only six members (two models × two scalers plus a hyper-parameter variant of Isolation Forest) and the same candidate (sgd_ocsvm_rbf) wins for all combined detectors across all three α values, so the choice is robust. The bias is absent by construction in the crossCVE transfer protocol of Section 4.3, where the best candidate is selected on the source test frame and then applied unchanged to the target frame. The crossCVE F1 numbers in Table 4 are therefore the more conservative measurement and the primary anchor of our discussion. 4.3
Cross-CVE transfer protocol
The transfer protocol is shown in Algorithm 2. The calibration set is always the normal-only split of the source scenario, so the threshold has never been exposed to the target normal distribution. The realised FPR on the target test frame is reported independently of the target FPR: it directly measures the cost in false alarms paid by the transferred threshold on a new normal profile. 4.4
Combined CWE detector
The combined detector treats the CWE class as a single training distribution. Its fit, calibration, and test frames are the union of the corresponding frames of
From CVE to CWE: Syscall-Based HIDS Generalisation
7
Table 2: Feature sets used for CWE-307 (see Section 4.5). Name all clean stable stable_imp score_l0p0_top20 score_lλ_top20
Size Construction 66 every numeric feature 53 low-variance + correlated features removed 26 two-sample KS-distance < 0.2 on both CVE normals 20 stable intersected with top-20 by importance 20 top-20 by importance only (λ = 0) 20 top-20 by importance, KS-shift penalty λ ∈ {0.25, 0.5, 1}
Algorithm 3 Importance–stability feature score Require: source normal Ns , target normal Nt , source labelled Ls , top-k, penalty λ Ensure: ranked feature list F 1: I ← PermutationImportance(Ls ) ▷ normalised to [0, 1] 2: for each feature f do 3: df ← KSDist(Ns [f ], Nt [f ]) 4: end for 5: for each feature f do 6: rf ← If − λ df 7: end for 8: F ← features sorted by rf in descending order, top-k 9: return F
all CVEs in the class. The model, scaler, and threshold are selected by Algorithm 1 on the unioned data. This is the most charitable operationalisation of the hypothesis stated in Section 3. 4.5
Feature selection
To answer RQ4 we build six feature sets, listed in Table 2. Algorithm 3 computes the most important construction: the joint stability/importance score with a tunable shift penalty. Algorithm 3 expresses the methodological question of RQ4: should a feature with a large normal-domain shift be discarded because it does not transfer, or kept because it carries attack signal? Setting λ = 0 keeps all important features regardless of shift; λ → ∞ forces the selection to coincide with the stable set.
5
Experimental Results
Figure 1 shows the calibrated detection pipeline. All experiments use seed 42 and the python package versions listed in requirements.txt; full reports are stored as CSV files so that any reported metric can be traced back to a model, scaler, threshold quantile and seed.
8
Kozachok, Vyugov, Magomedov
Container syscall trace
Sliding-window feat. extractor
Normal-only training
Normal feature matrix FPR-calibrated threshold
One-class model zoo
Calibrated threshold
CWE decision
self / cross-CVE / combined evaluation
Fig. 1: Calibrated one-class CWE detection pipeline. Normal-only training and calibration on the left; target FPR sets the threshold; the decision on the right is binary at window level and supports self, cross-CVE and combined evaluations.
Per-CVE detector
CWE-level detector (this work)
CVE-2012-2122
modeli
CWE-307
Brute + CVE-2012-2122 combined normal profile
EPS_CWE-434
modeli
CWE-434
EPS + PHP combined normal profile
CWE-89-SQLi
modeli
CWE-89
SQLi + Juice-Shop combined normal profile
One model per CVE: no transfer to a new exploit of the same defect class
Single model per CWE class: combined normal profile generalises to new CVEs of the same class
Fig. 2: Per-CVE detection (left) versus the CWE-level detector studied in this paper (right). The right panel pools the normal profiles of several CVEs that share a CWE class into a single combined detector.
Figure 2 contrasts the two modes of HIDS we compare: a separate detector per CVE on the left and a CWE-level detector on the right. RQ2 and RQ3 quantify whether the right-hand mode is empirically reachable. 5.1
RQ1: self-detection at calibrated FPR
Table 3 reports the best self-detection candidate for every scenario at the three target FPRs. Self-detection is consistently weak: even the most charitable operating point (α = 0.05) yields F1 ≤ 0.31 for all six scenarios. CWE-307 scenarios reach higher precision when the realised FPR is low (e.g. 0.93 on CVE-2012-2122 at α = 0.01), but at the cost of recall below 7%. The picture is consistent with prior reports on LID-DS [8]: per-scenario one-class HIDS recovers only a small fraction of exploit windows when the threshold is not tuned on labels. Reading the F1 figure. Two design factors push the F1 of Table 3 downward and must be kept in mind. First, the threshold quantile is fixed by α on normals
From CVE to CWE: Syscall-Based HIDS Generalisation
9
Table 3: Self-detection at three calibrated target FPRs (best candidate per row). CWE
Scenario
α realised FPR Precision Recall
CWE-307 Bruteforce_CWE-307 0.01 CWE-307 Bruteforce_CWE-307 0.05 CWE-307 CVE-2012-2122 0.01 CWE-307 CVE-2012-2122 0.05 CWE-89 CWE-89-SQL-injection 0.05 CWE-89 Juice-Shop 0.05 CWE-434 EPS_CWE-434 0.05 CWE-434 PHP_CWE-434 0.05
0.0315 0.0834 0.0099 0.0498 0.0512 0.0518 0.0899 0.0487
F1
0.1870 0.1652 0.1754 0.1222 0.2646 0.1671 0.9301 0.0637 0.1192 0.8443 0.1304 0.2259 0.3546 0.2197 0.2713 0.1809 0.1059 0.1336 0.0665 0.1575 0.0935 0.1202 0.1769 0.1431
alone, so the operating point is not F1-optimal by construction; this is the price paid for not seeing exploit labels during threshold selection. Second, several test frames are strongly imbalanced (e.g. CVE-2012-2122 has 233 425 exploit windows against 112 723 normal windows in Table 1), so even a perfectly calibrated FPR = 0.01 yields only ∼1 000 FP against tens of thousands of FN at low recall. The low F1 numbers therefore measure how much exploit signal a single-CVE normal sees through this fixed operating point, not the upper bound of the underlying detectors; we treat them as the methodological baseline against which RQ2 and RQ3 are compared. 5.2
RQ2: cross-CVE transfer is direction-dependent
Figure 3 visualises transfer F1 inside each CWE family. The diagonal entries are self-detection (uncalibrated baseline), the off-diagonal entries are cross-CVE transfer with the source-tuned candidate. The asymmetry for CWE-307 is striking: Bruteforce_CWE-307→CVE-2012-2122 yields F1 = 0.8054, whereas the reverse direction collapses to 0.0782. Two observations follow. First, transfer can be very strong: the union of Bruteforce-style attempts contains the behavioural footprint of the CVE-20122122 brute-force scenario, so the source normal profile is a superset of the target normal profile. Second, the reverse is not true: the CVE-2012-2122 normal profile is much narrower, and applying it to Bruteforce’s normal raises essentially everything above threshold, which explains the high recall but minuscule precision in Table 4. 5.3
RQ3: a combined CWE-307 detector pays off
Combining the two CWE-307 normals into a single fit/calibration/test pool gives the strongest detector of the entire study. At α = 0.01, the combined detector hits precision = 0.9642, recall = 0.4368, F1 = 0.6013 with a realised FPR of 0.0179. Raising α to 0.05 trades realised FPR 0.0702 for F1 = 0.6976. Table 5 contrasts the three CWE families at the same target FPRs. CWE307 dominates by an order of magnitude. CWE-89 and CWE-434 collapse below
10
Kozachok, Vyugov, Magomedov
Cross-CVE transfer F1 (diagonal: self, off-diagonal: source target) 1.0
0.14
0.13
SQLi
Juice
Brute CVE-2012
Target
0.11
0.07
0.08
0.14
0.4
EPS
PHP
0.2
Target
Target
F1 on target
0.31
0.18
EPS
0.08
0.27
0.8
PHP
0.81
CWE-434
SQLi
0.18
CWE-89
Juice
Source
CVE-2012 Brute
CWE-307
0.6
0.0
Fig. 3: Cross-CVE transfer F1 inside each CWE family. The diagonals show selfdetection (uncalibrated). The off-diagonal cells show the F1 of an anomaly model fitted on the source CVE and applied to the target CVE.
Table 4: Calibrated cross-CVE transfer for CWE-307. Realised FPR is the share of target normal windows above the source-set threshold. Rows marked † are operationally unusable (realised FPR ≥ 0.6 on target normal); the F1 values for those rows are reported only to make the asymmetry visible and should not be read as detector performance. Source → Target
Model
α realised FPR Precision Recall
Brute→CVE-2012-2122 IF 0.001 Brute→CVE-2012-2122 SGD-OCSVM 0.01 Brute→CVE-2012-2122 SGD-OCSVM 0.05 CVE-2012-2122→Brute SGD-OCSVM 0.001 CVE-2012-2122→Brute IF 0.01 CVE-2012-2122→Brute IF 0.05
†
0.9831 0.6331† 0.7814† 0.0228 0.6510† 0.9257†
F1
0.6426 0.8534 0.7331 0.7379 0.8608 0.7946 0.7137 0.9405 0.8115 0.0400 0.0216 0.0281 0.0467 0.7277 0.0878 0.0413 0.9092 0.0790
F1 = 0.21, with precision falling to 0.28 and 0.12 at α = 0.05. The combined detector therefore confirms the hypothesis for CWE-307 but refutes it – with current features – for CWE-89 and CWE-434. 5.4
RQ4: stability filters can hurt transfer
Figure 6 ranks 16 features of the 66 by their two-sample KS distance between Bruteforce and CVE-2012-2122 normals. The stable group is dominated by resource features that are essentially constant in both scenarios (the sc_size counters of lseek, pread, sendto) and by inter-event time-delta histogram bins. The shifted group is dominated by data-volume features (the sc_size counters of pwrite, writev, read, brk) and by PID-switch frequency. If RQ4 were affirmative, restricting the model to the stable set should improve transfer. Figure 7 shows the opposite. The stable set collapses transfer F1
From CVE to CWE: Syscall-Based HIDS Generalisation
11
Table 5: Combined CWE-level detectors at three calibrated target FPRs. CWE
α realised FPR Precision Recall
CWE-307 0.001 CWE-307 0.01 CWE-307 0.05 CWE-89 0.001 CWE-89 0.01 CWE-89 0.05 CWE-434 0.001 CWE-434 0.01 CWE-434 0.05
0.0017 0.0179 0.0702 0.0010 0.0079 0.0381 0.0026 0.0159 0.0560
F1
FP
FN
0.9902 0.1589 0.2739 376 200 142 0.9642 0.4368 0.6013 3 859 134 010 0.8994 0.5698 0.6976 15 163 102 369 0.6930 0.0243 0.0469 144 13 051 0.5002 0.0893 0.1516 1 194 12 181 0.2810 0.1674 0.2098 5 728 11 137 0.3021 0.0299 0.0544 402 5 652 0.2023 0.1054 0.1386 2 421 5 212 0.1168 0.1933 0.1456 8 517 4 700
from 0.8054 (with all) to 0.0348 in the strong direction; the stable_important subset recovers some signal but only in the weak direction (F1 0.1357 vs. 0.0782 with all). The score family (Algorithm 3) with λ = 0 – importance only, no shift penalty – gives the best of the 20-dimensional feature sets, retaining most of the strong-direction signal. The interpretation is that features with the largest normal-domain shift can also carry the attack signal: data-volume features change between two normal workloads, but they also change between normal and exploit windows of either workload. A stability filter therefore removes both nuisance shift and useful signal, and the net effect on transfer F1 is negative.
6
Discussion
Why CWE-307 generalises. The two CWE-307 scenarios share a strongly repetitive behavioural footprint: short connect–read–write–close cycles on authentication ports. Brute-force traffic dominates the normal profile of the Bruteforce scenario to such an extent that the model has effectively seen the exploit signal during normal training. CVE-2012-2122 reuses that behavioural class with different process names and arguments, so the source-fit detector still recognises the attack pattern after the application-level cosmetic differences are smoothed out by the scaler. Quantifying the asymmetry. The reviewer-driven follow-up question is whether “the Bruteforce normal is a superset of CVE-2012-2122 normal” can be backed quantitatively. We compute, per CWE family, the two-sample KS distance between the normal-window distributions of the two scenarios for every one of the 66 features, then summarise the distribution. Table 6 reports the minimum, mean, and median KS distances together with the count of stable features (KS < 0.2). The contrast is striking: CWE-307 has 18 such features and a minimum KS of 6 × 10−4 , whereas CWE-89 has only 2 (minimum KS 0.149) and CWE-434 has 5 (minimum KS 0.139). The two CWE-307 normals share a nearidentical sub-space; the CWE-89 and CWE-434 normals do not. The “superset”
12
Kozachok, Vyugov, Magomedov
1.0
Detection F1 across protocols and CWE families Self (best) Cross-CVE transfer (best) Combined, uncalibrated Combined, calibrated
F1-score
0.8 0.6 0.4 0.2 0.0
CWE-307
CWE-89
CWE-434
Fig. 4: F1 across protocols and CWE families. “Best transfer” is taken over the seven feature sets of Table 2; “combined, uncalibrated” is the highest F1 attainable by sweeping the anomaly-score quantile over the joint test frame of the two CVEs (label-tuned upper bound, included only for reference); “combined, calibrated” is the value at the best target FPR under Algorithm 1.
Table 6: Two-sample KS-distance summary between the two normal-window distributions of each CWE family, taken over the post-clean-filter feature set (d=53 for CWE-307/89, d=54 for CWE-434). “Stable” counts features with KS < 0.2. CWE
scenarios paired
min KS mean KS median KS # stable
CWE-307 Bruteforce vs. CVE-2012-2122 0.0006 CWE-89 SQL-injection vs. Juice-Shop 0.1492 CWE-434 EPS vs. PHP 0.1390
0.457 0.595 0.587
0.477 0.560 0.605
18 2 5
interpretation is therefore consistent with the KS-shift profile, and the limited normal-profile overlap in CWE-89 and CWE-434 is by itself sufficient to predict their weak combined-detector performance. Why CWE-89 and CWE-434 do not. For CWE-89 (SQL injection) the perwindow feature space is dominated by HTTP-request volumetric features that change wildly between Juice-Shop and the standalone SQL-injection scenario; for CWE-434, the EPS and PHP scenarios share the logical pattern (upload, then execute) but disagree on which syscalls carry it (e.g. different execve chains in PHP). The KS analysis in Table 6 corroborates these qualitative explanations: the most shifted features for CWE-89 are tid_count (KS 0.999), pid_switch_frequency (0.983) and pid_count (0.974); these are applicationidentity proxies rather than CWE-specific signals. For CWE-434 the leaders are the sc_size byte counters of munmap, mmap, brk and pread, all of which encode
From CVE to CWE: Syscall-Based HIDS Generalisation
13
Metric on combined CWE-307 test set
Combined CWE-307 detector: precision-recall tradeoff 1.0 0.8 Precision Recall F1-score Realised FPR Target FPR (ideal)
0.6 0.4 0.2 0.0
10 3
10 2
Calibration target FPR (log scale)
10 1
Fig. 5: Combined CWE-307 detector under three target FPRs. The realised FPR tracks the target FPR closely, which is the desired behaviour of Algorithm 1. Recall and F1 grow with α, while precision declines smoothly.
memory-management patterns specific to the runtime (PHP vs. EPS) rather than the upload-then-execute motif. The feature extractor does not surface a single upload-then-execute temporal motif, so the residual CWE-invariant signal is small relative to the application-level shift. Calibration matters. Table 4 shows that uncalibrated cross-CVE transfer can appear deceptively strong: the source-only model marks almost every target normal window as anomalous, which inflates recall but is operationally useless. The realised FPR is the right number to inspect first: if it exceeds the target FPR by an order of magnitude, the transfer has failed even when recall looks high. We recommend always reporting realised FPR beside precision/recall/F1 in CWE-level evaluations. Stability is not transferability. RQ4 contradicts the intuition that “the more stable a feature is across two normals, the better it transfers”. As discussed in Section 5.4, useful signal can live in the shifted tail of the feature distribution. A defensible feature selection criterion for CWE-level HIDS must therefore combine cross-CVE attack importance with a controlled shift penalty, of which Algorithm 3 is the simplest form. Limitations. The study covers three CWE families with two CVEs each; broader CWE coverage is needed to claim general empirical conclusions. We use six of the LID-DS-2021 scenarios in total; LID-DS-2021 ships further scenarios labelled
14
Kozachok, Vyugov, Magomedov
Per-feature normal-domain shift inside CWE-307 sc_size_pwrite sc_size_writev pid_switch_frequency sc_size_read sc_size_brk sc_size_munmap sc_size_mmap sc_size_write time_delta_bin_30 time_delta_bin_31 time_delta_bin_22 time_delta_bin_29 time_delta_bin_28 sc_size_sendto sc_size_pread sc_size_lseek
stable ( < 0.2) moderate (0.2--0.7) shifted ( > 0.7)
0.0
0.2
0.4
0.6
0.8
1.0
Mean KS-distance between normal-window distributions of two CVEs
Fig. 6: Two-sample KS distance between the normal-window distributions of the two CWE-307 scenarios. Resource-size and PID-switch features dominate the shifted group; the lseek and pread byte counters are essentially identical in both normals.
with additional CWE classes (e.g. CWE-22 path traversal, CWE-94 code injection) that are not yet covered here. Our feature extractor follows Peng Guo [11]; richer representations – graph models of process syscall sequences (PSSG), interprocess graphs, or contrastive embeddings [25,31] – are likely necessary to make CWE-89 and CWE-434 work. Threshold calibration assumes that the calibration normal is representative of operational normal; in production this assumption must be revisited periodically. Author identification has been redacted in the current draft (the title page uses placeholder names); the camera-ready version will restore real author metadata.
7
Conclusion
The transition from CVE-level to CWE-level detection in syscall-based HIDS is empirically feasible but not uniform across weakness classes. With a Peng-Guostyle 66-dimensional feature vector, calibrated one-class learning, and a normalonly threshold protocol, a single combined detector for CWE-307 achieves F1 = 0.6976 at realised FPR = 0.0702, comparable to strong per-scenario baselines. The same protocol fails for CWE-89 and CWE-434 (best F1 ≤ 0.21). CrossCVE transfer is strongly direction-dependent and governed by the breadth of the source normal profile rather than by the shared CWE label. Feature filters that maximise normal-domain stability across two CVEs can destroy the transferable signal; importance-driven selection with a controlled shift penalty is preferable. Two methodological recommendations follow. First, threshold calibration must be decoupled from exploit labels: any apparent CWE-level transfer that disappears under realised-FPR reporting was an artefact of label-tuned thresholds. Second, future CWE-level HIDS should either enrich the feature space
From CVE to CWE: Syscall-Based HIDS Generalisation
1.0
Feature-set impact on cross-CVE transfer inside CWE-307 Bruteforce CVE-2012-2122 CVE-2012-2122 Bruteforce
0.8
Transfer F1
15
0.6 0.4 0.2 0.0
6)
all (6
clean
(53)
stable
) ) ) (26) 0 (20 0 (20 p (20 p p m i 0 1 l l _ _ _ e l e e stab scor scor
Fig. 7: Effect of feature filters on cross-CVE transfer F1 inside CWE-307. The most aggressive normal-domain stability filter (stable) destroys the strong direction; importance-only top-20 (score_l0p0) preserves most of it.
with structural patterns that are invariant to application identity – graph-based syscall models [11] and contrastive prototype embeddings [25] are concrete candidates – or adopt explicit multi-task formulations [22,24] that train the representation to be CWE-discriminative on labelled data. Both directions are open for future work. Acknowledgements The experiments use LID-DS-2021 [8]. Software dependencies are listed in requirements.txt; the random seed and command-line invocations are recorded in EXPERIMENTS.md. Conflict of Interest The authors declare no conflict of interest. Data Availability LID-DS-2021 is publicly available [8]. All experiment outputs referenced in this paper – the per-scenario CSV grids, the calibrated summaries, and the feature-selection scores – are produced by the scripts in the public repository accompanying this submission.
References 1. Forrest, S., Hofmeyr, S.A., Somayaji, A., Longstaff, T.A.: A sense of self for Unix processes. In: Proc. IEEE Symp. Security and Privacy, pp. 120–128 (1996). doi: 10.1109/SECPRI.1996.502675
16
Kozachok, Vyugov, Magomedov
2. Hofmeyr, S.A., Forrest, S., Somayaji, A.: Intrusion detection using sequences of system calls. J. Comput. Secur. 6(3), 151–180 (1998). doi:10.3233/JCS-980109 3. Liao, Y., Vemuri, V.R.: Use of k-nearest neighbor classifier for intrusion detection. Comput. Secur. 21(5), 439–448 (2002). doi:10.1016/S0167-4048(02)00514-X 4. Kang, D.K., Fuller, D., Honavar, V.: Learning classifiers for misuse and anomaly detection using a bag of system calls representation. In: Proc. IEEE SMC Information Assurance Workshop, pp. 118–125 (2005). doi:10.1109/IAW.2005.1495944 5. Maggi, F., Matteucci, M., Zanero, S.: Detecting intrusions through system call sequence and argument analysis. IEEE Trans. Depend. Secur. Comput. 7(4), 381– 395 (2010). doi:10.1109/TDSC.2008.69 6. Creech, G., Hu, J.: A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns. IEEE Trans. Comput. 63(4), 807–819 (2014). doi:10.1109/TC.2013.13 7. Grimmer, M., Roehling, M.M., Kreusel, D., Rechert, K.: A modern and sophisticated host based intrusion detection data set. In: D-A-CH Security 2019, pp. 135– 145. syssec (2019) 8. Grimmer, M., Kaelble, T., Rucks, F., Pirl, J.: LID-DS 2021 – A modern host-based intrusion detection data set. Mendeley Data, v3 (2021). doi:10.17632/4xj3p3z5kj.3 9. Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation Forest. In: Proc. ICDM 2008, pp. 413– 422. IEEE (2008). doi:10.1109/ICDM.2008.17 10. Schölkopf, B., Platt, J.C., Shawe-Taylor, J., Smola, A.J., Williamson, R.C.: Estimating the support of a high-dimensional distribution. Neural Comput. 13(7), 1443–1471 (2001). doi:10.1162/089976601750264965 11. Guo, P.: Intrusion detection based on complete system call information. In: Proc. DSAI 2024, pp. 1–5. ACM (2024). doi:10.1145/3677892.3677893 12. El Khairi, A., Caselli, M., Knierim, C., Peter, A., Continella, A.: Contextualizing system calls in containers for anomaly-based intrusion detection. In: Proc. ACM Cloud Computing Security Workshop (CCSW), pp. 9–21 (2022). doi:10.1145/ 3560810.3564266 13. Sommer, R., Paxson, V.: Outside the closed world: on using machine learning for network intrusion detection. In: Proc. IEEE Symp. Security and Privacy, pp. 305– 316 (2010). doi:10.1109/SP.2010.25 14. Tunde-Onadele, O., He, J., Dai, T., Gu, X.: A study on container vulnerability exploit detection. In: Proc. IEEE IC2E, pp. 121–127 (2019). doi:10.1109/IC2E. 2019.00026 15. Lin, Y., Tunde-Onadele, O., Gu, X.: CDL: Classified distributed learning for detecting security attacks in containerized applications. In: Proc. ACSAC, pp. 179–188 (2020). doi:10.1145/3427228.3427236 16. Lin, Y., Tunde-Onadele, O., Gu, X., He, J., Latapie, H.: SHIL: Self-supervised hybrid learning for security attack detection in containerized applications. In: Proc. IEEE ACSOS, pp. 41–50 (2022). doi:10.1109/ACSOS55765.2022.00022 17. Tunde-Onadele, O., Lin, Y., Gu, X., He, J., Latapie, H.: A self-supervised machine learning framework for online container security attack detection. ACM Trans. Auton. Adapt. Syst. 19(3), 17 (2024). doi:10.1145/3665795 18. Suneja, S., Kanso, A., Le, M., Isci, C.: SecQuant: quantifying container security exposure. In: Proc. ESORICS 2022, LNCS 13554, pp. 525–546. Springer (2022). doi:10.1007/978-3-031-17143-7_26 19. Aghaei, E., Shadid, W., Al-Shaer, E.: ThreatZoom: CVE2CWE using hierarchical neural network. In: Proc. SecureComm 2020, LNICST 335, pp. 23–41. Springer (2020). doi:10.1007/978-3-030-63086-7_2
From CVE to CWE: Syscall-Based HIDS Generalisation
17
20. Das, S.S., Serra, E., Halappanavar, M., Pothen, A., Al-Shaer, E.: V2W-BERT: A framework for effective hierarchical multiclass classification of software vulnerabilities. In: Proc. IEEE DSAA 2021, pp. 1–12 (2021). doi:10.1109/DSAA53316.2021. 9564227 21. Pan, S., Bao, L., Xia, X., Lo, D., Li, S.: Fine-grained commit-level vulnerability type prediction by CWE tree structure. In: Proc. ICSE 2023, pp. 957–969 (2023). doi:10.1109/ICSE48619.2023.00088 22. Li, L., Ding, S.H.H., Tian, Y., Fung, B.C.M., Charland, P., Ou, W., Song, L., Chen, C.: VulANalyzeR: Explainable binary vulnerability detection with multitask learning and attentional graph convolution. ACM Trans. Priv. Secur. 26(3), 1–25 (2023). doi:10.1145/3585386 23. Atiiq, S.A., Gehrmann, C., Dahlen, K., Khalil, K.: From generalist to specialist: exploring CWE-specific vulnerability detection. In: Proc. ARES 2024, pp. 1–12 (2024). doi:10.1145/3664476.3670872 24. Uddin, M.A., Aryal, S., Bouadjenek, M.R., Al-Hawawreh, M., Talukder, M.A.: Hierarchical classification for intrusion detection system: effective design and empirical analysis. arXiv:2403.13013 (2024). https://arxiv.org/abs/2403.13013 25. Lopez-Martin, M., Sanchez-Esguevillas, A., Arribas, J.I., Carro, B.: Supervised contrastive learning over prototype-label embeddings for network intrusion detection. Inf. Fusion 79, 200–228 (2022). doi:10.1016/j.inffus.2021.09.014 26. Bhuyan, M.H., Bhattacharyya, D.K., Kalita, J.K.: Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutor. 16(1), 303–336 (2014). doi:10.1109/SURV.2013.052213.00046 27. Garcia-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., Vázquez, E.: Anomalybased network intrusion detection: techniques, systems and challenges. Comput. Secur. 28(1–2), 18–28 (2009). doi:10.1016/j.cose.2008.08.003 28. Aslan, Ö., Samet, R.: A comprehensive review on malware detection approaches. IEEE Access 8, 6249–6271 (2020). doi:10.1109/ACCESS.2019.2963724 29. MITRE Corporation: Common Weakness Enumeration, version 4.15. https://cwe. mitre.org/ (Accessed: 1 May 2026) 30. MITRE Corporation: CVE Program. https://www.cve.org/ (Accessed: 1 May 2026) 31. Zhang, J., Wei, F., Hu, X., Yang, B., Xie, F., Liu, S.: MCLDM: multi-channel contrastive learning network for intrusion detection. Comput. Netw. 237, 110083 (2023). doi:10.1016/j.comnet.2023.110083 32. Canbek, G., Temizel, T.T., Sagiroglu, S.: PToPI: A comprehensive review, analysis, and knowledge representation of binary classification performance measures/metrics. SN Comput. Sci. 4, 13 (2022). doi:10.1007/s42979-022-01409-1 33. Rahimi, A., Recht, B.: Random features for large-scale kernel machines. In: Adv. Neural Inf. Process. Syst. 20 (NIPS 2007), pp. 1177–1184. MIT Press (2008).