1 Introduction
1.1 IDS Components, Types, and Challenges
1.2 IDS Location
1.3 Scope & Organization
2 Related Surveys
3 System Log and System Audit Data IDSs
3.1 System Logs IDSs
3.2 Audit Data IDSs
4 System Call IDSs
4.1 Sequential Features (n-Grams)
4.2 Frequency-Based Features: A Cheaper Alternative
4.3 Hidden Markov Models (HMMs) for System Call Modeling
4.4 Other System Call IDS Works
4.5 Using System Call Arguments and Additional Data
4.6 System Call Mimicry Attacks
5 Windows Registry IDSs
6 File System IDSs
7 Program Analysis and Monitoring Techniques
8 Host-Relevant Algorithms Tested on Network Traffic
9 Conclusion
9.1 Suggested Future Directions