Surekha, Mariam Varghese; Dr.Poulose Jacob, K(Cochin University of Science & Technology, March , 2008)
[+]
[-]
Abstract:
Modern computer systems are plagued with stability and security
problems: applications lose data, web servers are hacked, and systems crash under
heavy load. Many of these problems or anomalies arise from rare program
behavior caused by attacks or errors. A substantial percentage of the web-based
attacks are due to buffer overflows. Many methods have been devised to detect
and prevent anomalous situations that arise from buffer overflows. The current
state-of-art of anomaly detection systems is relatively primitive and mainly
depend on static code checking to take care of buffer overflow attacks. For
protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on
frequencies of system calls in the system call trace. System call traces represented
as frequency sequences are profiled using sequence sets. A sequence set is
identified by the starting sequence and frequencies of specific system calls. The
deviations of the current input sequence from the corresponding normal profile in
the frequency pattern of system calls is computed and expressed as an anomaly
score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system
calls represented using sequence sets, captures the normal behavior of programs
under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show
that Bayesian Network on frequency variations responds effectively to induced
buffer overflows. It can also help administrators to detect deviations in program
flow introduced due to errors.
Description:
Department of Computer
Science, Cochin University of Science and Technology.
Poulose Jacob,K; Surekha, Mariam Varghese(2007 ACADEMY PUBLISHER, December 1, 2007)
[+]
[-]
Abstract:
This paper discusses our research in developing
a generalized and systematic method for anomaly detection.
The key ideas are to represent normal program behaviour
using system call frequencies and to incorporate
probabilistic techniques for classification to detect
anomalies and intrusions. Using experiments on the
sendmail system call data, we demonstrate that concise and
accurate classifiers can be constructed to detect anomalies.
An overview of the approach that we have implemented is
provided.