Intrusion Detection using Sequences of System Calls

DMCA

Intrusion Detection using Sequences of System Calls (1998)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Steven A. Hofmeyr , Stephanie Forrest , Anil Somayaji

Venue:	Journal of Computer Security
Citations:	396 - 15 self

BibTeX

@ARTICLE{Hofmeyr98intrusiondetection,
    author = {Steven A. Hofmeyr and Stephanie Forrest and Anil Somayaji},
    title = {Intrusion Detection using Sequences of System Calls},
    journal = {Journal of Computer Security},
    year = {1998},
    volume = {6},
    pages = {151--180}
}

OpenURL

Abstract

A method is introducted for detecting intrusions at the level of privileged processes. Evidence is given that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two ways: Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case several types of intrusive behavior were studied; in the latter case, results were analyzed for false positives. 1 Introduction Modern computer systems are plagued by security vulnerabilities. Whether it is the latest UNIX buffer overflow or bug in Microsoft Internet Explorer, our applications and operating systems are full of security flaws on many levels. From the viewpoint of the traditional security paradigm, it should be possible to eliminate such problems through more exten...

Keyphrases

system call intrusion detection actual execution good discriminator short sequence false positive unix buffer overflow security vulnerability live user environment privileged process several common unix program former case several type latter case security flaw introduction modern computer system many level traditional security paradigm microsoft internet explorer intrusive behavior normal behavior many normal mode

DMCA