Host-Based Intrusion Detection Systems for Resource Constrained Environments: A Review

A Host Based Intrusion Detection System is a potent security component that can be deployed on to a computer system to detect anomalies in system behavior. For a long time, Host Based Intrusion Detection systems have been audit based. However, audit-based systems are unable to detect zero-day exploits and Advanced Persistent Threat attacks. This literature review examines some of the recent research in anomalous behavior detection that can run in real time to combat zero-day exploits and other cyber threats. The review shows that there is emerging potential in this research especially in the area of Provenance-based Intrusion Detection Systems which are a fusion between the audit-based and behavior-based systems. Some of the research demonstrates the ability to detect threats in real time and doing so while executing in a low compute environment or with minimal impact to system resources.