Analisis Perbandingan Kinerja Fine-Tuning Varian Pretrained Bert Untuk Deteksi Intrusi Berbasis Host Pada Dataset Adfa-Ld

Abstract

Host-based intrusion detection plays an important role in safeguarding system integrity by analyzing internal host activities through system call sequences, yet emerging attack patterns increasingly manifest as subtle sequential deviations rather than isolated events, making them difficult to distinguish from legitimate behavior. Conventional machine learning and deep learning approaches often fall short in this setting, as they require training from scratch and lack the ability to leverage cross-domain knowledge. Recent studies have explored the use of BERT for this task, but comprehensive evaluations comparing its pretrained variants remain limited. Addressing this gap, this study investigates the performance of several BERT variants and identifies effective training configurations for intrusion detection on the ADFA-LD dataset. The methodology encompasses data preprocessing, model fine-tuning, and hyperparameter exploration to assess the contribution of each component to predictive quality. The findings reveal notable trade-offs between accuracy and computational efficiency across model variants, while also demonstrating that preprocessing choices and hyperparameter selection substantially influence overall performance. Specifically, BERT-BASE achieves the highest F1-score of 0.9552, whereas DistilBERT reduces inference time by over 60% (44.97 seconds) and GPU memory usage by approximately 37% (274.94 MB) compared to BERT-BASE, with only a minor F1- score degradation of about 0.6%. These insights provide a foundation for more informed architectural and training decisions in the development of transformerbased HIDS models.