A Comparative Study of Fine-Tuned Pretrained BERT Models for Host-Based Intrusion Detection Using the ADFA-LD Dataset

DOI

10.2991/978-94-6239-828-3_13How to use a DOI?

Keywords

Host-Based Intrusion Detection; BERT; System Calls; Model Efficiency

Abstract

Host-based intrusion detection uses host activity, including system-call sequences, to distinguish intrusive behavior from normal execution. Although pretrained Bidirectional Encoder Representations from Transformers (BERT) models offer several architectural and computational profiles, their relative behavior for this task has received limited comparative evaluation. This study evaluates five pretrained BERT variants on the Australian Defence Force Academy Linux Dataset (ADFA- LD) under a common binary classification setting. The experiments ex- amine sliding-window n-gram representation and overlap removal, compare fine-tuned model variants, and explore DistilBERT training configurations. In the architecture comparison, BERT-BASE records the highest F1-score of 95.52%, while DistilBERT records 94.98%. DistilBERT also provides the most favorable observed performance-efficiency balance. Its timed evaluation phase, which covered data and model loading and the batched prediction loop, took 44.97 seconds. During this evaluation routine, peak allocated GPU memory was 274.94 MB. Relative to BERT-BASE, these values represent reductions of 60.7% and 37.1%, respectively. The results characterize the practical trade-off between detection performance and computational requirements when selecting a pretrained BERT variant for system-call-based intrusion detection.

Copyright

© 2026 The Author(s)

Open Access

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial 4.0 International License (http://creativecommons.org/licenses/by-nc/4.0/), which permits any noncommercial use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

Download article (PDF)

TY  - CONF
AU  - Salsa Zufar Radinka Akmal
AU  - Tirana Noor Fatyanosa
AU  - Mahendra Data
PY  - 2026
DA  - 2026/11/04
TI  - A Comparative Study of Fine-Tuned Pretrained BERT Models for Host-Based Intrusion Detection Using the ADFA-LD Dataset
BT  - Proceedings of the 2026 11th International Conference on Sustainable Information Engineering and Technology (SIET 2026)
PB  - Atlantis Press
SP  - 143
EP  - 154
SN  - 2589-4900
UR  - https://doi.org/10.2991/978-94-6239-828-3_13
DO  - 10.2991/978-94-6239-828-3_13
ID  - Akmal2026
ER  -