Information Hiding

Volume 2578 of the series Lecture Notes in Computer Science pp 1-17


Hiding Intrusions: From the Abnormal to the Normal and Beyond

  • Kymie TanAffiliated withDepartment of Computer Science, Carnegie Mellon University
  • , John McHughAffiliated withCERT ®Coordination Center and Center for Computer and Communications Security, Carnegie Mellon University
  • , Kevin KillourhyAffiliated withDepartment of Computer Science, Carnegie Mellon University

* Final gross prices may vary according to local VAT.

Get Access


Anomaly based intrusion detection has been held out as the best (perhaps only) hope for detecting previously unknown exploits. We examine two anomaly detectors based on the analysis of sequences of system calls and demonstrate that the general information hiding paradigm applies in this area also. Given even a fairly restrictive definition of normal behavior, we were able to devise versions of several exploits that escape detection. This is done in several ways: by modifying the exploit so that its manifestations match “normal,” by making a serious attack have the manifestations of a less serious but similar attack, and by making the attack look like an entirely different attack. We speculate that similar attacks are possible against other anomaly based IDS and that the results have implications for other areas of information hiding.