An Intrusion Detection Method Based on System Call Temporal Serial Analysis

  • Shi Pu
  • Bo Lang
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4681)

Abstract

System call sequences are useful criteria to judge the behaviors of processes. How to generate an efficient matching algorithm and how to build up an implementable system are two of the most difficult problems. In this paper, we explore the possibility of extending consecutive system call to incorporate temporal signature to the Host-based Intrusion Detection System. In this model, we use the real-time detected system call sequences and their consecutive time interval as the data source, and use temporal signature to filter the real model. During the monitoring procedure, we use data mining methods to analyze the source dynamically and implement incremental learning mechanism. Through studying small size samples and incremental learning, the detecting ability of the system can be still good when the sample’s size is small. This paper also introduces the key technologies to build such a system, and verifies this intrusion detection method in real time environment. Finally, this paper gives the experiments results to verify the availability and efficiency of our system.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Yin, Q., Zhang, R.: A new intrusion detection method based on linear prediction. In: The 3rd international conference on Information security, vol. 85, pp. 160–165 (2004)Google Scholar
  2. 2.
    Jones, A., Li, S.: Temporal Signatures for Intrusion Detection. In: 17th Annual Computer Security Applications Conference (ACSAC’01), p. 0252 (2001)Google Scholar
  3. 3.
    S. Kumar, E. H. Spafford. A software architecture to support misuse intrusion detection. In: 18th National Information Security Conference, pp. 194-204 (1995)Google Scholar
  4. 4.
    Ilgun, K., Kemmerer, R.A., Porras, P.A.: State transition analysis: A rule-based intrusion detection approach. IEEE Transactions on Software Engineering 21(3), 181–199 (1995)CrossRefGoogle Scholar
  5. 5.
    Lunt, T., Tamaru, A., Gilham, F., Jagannathan, R., Neumann, P., Javitz, H., Valdes, A., Garvey, T.: A real-time intrusion detection expert system (IDES) - final technical report. Technical report, Computer Science Laboratory, SRI International, Menlo Park, California (1992)Google Scholar
  6. 6.
    Bro, V.P.: A system for detecting network intruders in real-time. Computer Networks 31(23-24), 2435–2463 (1999)CrossRefGoogle Scholar
  7. 7.
    Inc. Network Flight Recorder. Network flight recorder (1997), http://www.nfr.com
  8. 8.
    Forrest, S., Hofmeyr, S., Somayaji, S.: Computer Immunology. Communications of the ACM 40(10), 88–96 (1997)CrossRefGoogle Scholar
  9. 9.
    Lee, W., Stolfo, S.J.: Data mining approaches for intrusion detection. In: 7th USENIX Security Symposium (1998)Google Scholar
  10. 10.
    Lee, W., Stolfo, S.J: A Framework for Constructing Features and Models for Intrusion Detection Systems. ACM Transactions on Information and System Security 3(4), 227–261 (2000)CrossRefGoogle Scholar
  11. 11.
  12. 12.
  13. 13.
  14. 14.
    Feng, H.H., Giffin, J.T., Huang, Y., lha, S., Lee, W., Miller, B.P.: Formalizing Sensitivity in Static Analysis for Intrusion Detection. In: The 2004 IEEE Symposium on Security and Privacy, pp. 194–208 (2004)Google Scholar
  15. 15.
    Wanger, D., Dean, D.: Intrusion Detection via Static Analysis. In: The 2001 IEEE Symposim on Security and Privacy, pp. 156–168 (2001)Google Scholar

Copyright information

© Springer Berlin Heidelberg 2007

Authors and Affiliations

  • Shi Pu
    • 1
  • Bo Lang
    • 1
  1. 1.State Key Lab of Software Development Environment, Beijing University of Aeronautics and Astronautics, 100083, Beijing 

Personalised recommendations