Building an Application Data Behavior Model for Intrusion Detection

Abstract

Abstract. Application level intrusion detection systems usually rely on the immunological approach. In this approach, the application behavior is compared at runtime with a previously learned application profile of the sequence of system calls it is allowed to emit. Unfortunately, this approach cannot detect anything but control flow violation and thus remains helpless in detecting the attacks that aim pure application data. In this paper, we propose an approach that would enhance the detection of such attacks. Our proposal relies on a data oriented behavioral model that builds the application profile out of dynamically extracted invariant constraints on the application data items.

HPCgnature: a hardware‐based application‐level intrusion detection system

“…Current researches in the field of app‐IDS leverage system level models of the initial application, such that the modifications can be detected by the IDS. These models are mostly based on application system‐calls [11], events [12], control‐flow [13], or data‐flow [14, 15]. The models have evolved from naive sequences [16] in primary researches to more accurate models by use of complex techniques such as extreme learning machine [17].…”

“…On the one hand, the main shortcoming of existing methods is that they need to leverage dynamic application monitoring facilities inside the operating system (OS), use system/application instrumentation [13, 18] or alternatively use virtualisation [15, 19, 20] in order to obtain their required application traces. In other words, they need to trust the system software, which results in a large and complex trusted computing base (TCB).…”