Intrusion Detection Using Variable-Length Audit Trail Patterns

Wespi, Andreas; Daciér, Marc; Debar, Hervé

doi:10.1007/3-540-39945-3_8

Cited by 129 publications

(105 citation statements)

References 8 publications

Supporting

Mentioning

105

Contrasting

Order By: Relevance

“…In sequence enumeration, S. Forrest used fixed length system call sequence to describe normal software behavior in 1988. To overcome inflexibility of fixed length, Wepsi proposed a Variablelength model, called V-gram [4], which introduced variablelength patterns to find sequence patterns of system calls. HMM (Hide Markov Model) is the most representative approach in the field of machine learning.…”

Section: Related Workmentioning

confidence: 99%

Research on Software Trust Analysis Based on Behavior

Lai

Zhang

Yang

2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYIn this paper, we propose a new trusted modeling approach based on state graphs. We introduce a novel method of deriving state-layer from a system call sequence in terms of probability and statistics theory, and we identify the state sequence with the help of Hidden Markov Model (HMM). We generate state transition graph according to software executing process and pruning rules. Then, we separate local function graphs according to software specific functions by semantic analysis. The statelayer is a bridge between the basic behaviors and the upper layer functions of software to compensate semantic faults. In addition, a pruning strategy of formulating state graphs is designed to precisely describe each piece of software functions. Finally, a detecting system based on our model is proposed, and a case study of RSS software reveals how our system works. The results demonstrate that our trusted model describes software behaviors successfully and can well detect un-trust behaviors, anomaly behaviors, and illegal input behaviors.

show abstract

Section: Related Workmentioning

confidence: 99%

Research on Software Trust Analysis Based on Behavior

Lai

Zhang

Yang

2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…A significant amount of research has sought to detect such attacks through monitoring the behavior of the process and comparing that behavior to a model of "normal" behavior. Typically this model of "normal" is obtained either from the process' own previous behavior [10,27,9,8,13,12,37] or the behavior prescribed by the source code or executable of the program it executes [35,14,15].…”

Section: Introductionmentioning

confidence: 99%

Behavioral Distance for Intrusion Detection

Gao

Reiter

Song

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We introduce a notion, behavioral distance, for evaluating the extent to which processes-potentially running different programs and executing on different platforms-behave similarly in response to a common input. We explore behavioral distance as a means to detect an attack on one process that causes its behavior to deviate from that of another. We propose a measure of behavioral distance and a realization of this measure using the system calls emitted by processes. Through an empirical evaluation of this measure using three web servers on two different platforms (Linux and Windows), we demonstrate that this approach holds promise for better intrusion detection with moderate overhead.

show abstract

“…for comparison to the profile, typical anomaly detectors use system calls [6,[14][15][16][17] or function calls [5,18] as the granularity for events.…”

mentioning

confidence: 99%

Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths

Chapin

2004

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Many intrusions amplify rights or circumvent defenses by issuing system calls in ways that the original process did not. Defense against these attacks emphasizes preventing attacking code from being introduced to the system and detecting or preventing execution of the injected code. Another approach, where this paper fits in, is to assume that both injection and execution have occurred, and to detect and prevent the executing code from subverting the target system. We propose a method using waypoints: marks along the normal execution path that a process must follow to successfully access operating system services. Waypoints actively log trustworthy context information as the program executes, allowing our anomaly monitor to both monitor control flow and restrict system call permissions to conform to the legitimate needs of application functions. We describe our design and implementation of waypoints and present results showing that waypoint-based anomaly monitors can detect a subset of mimicry attacks and impossible paths.

show abstract

Intrusion Detection Using Variable-Length Audit Trail Patterns

Cited by 129 publications

References 8 publications

Research on Software Trust Analysis Based on Behavior

Research on Software Trust Analysis Based on Behavior

Behavioral Distance for Intrusion Detection

Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths

Contact Info

Product

Resources

About