CPL - Chalmers Publication Library
| Utbildning | Forskning | Styrkeområden | Om Chalmers | In English In English Ej inloggad.

Using system call information to reveal hidden attack manifestations

Ulf Larson (Institutionen för data- och informationsteknik, Nätverk och system (Chalmers) ) ; Dennis K. Nilsson (Institutionen för data- och informationsteknik, Datorteknik (Chalmers)) ; Erland Jonsson (Institutionen för data- och informationsteknik, Nätverk och system (Chalmers) ) ; S. Lindskog
Proceedings of the 1st International Workshop on Security and Communication Networks, IWSCN 2009 (2010)
[Konferensbidrag, övrigt]

We investigate how system call-based intrusion detectors can be made more resistant against mimicry attacks. We show that by including extra information such as system call arguments, return values, and identity of the user responsible for the calls, the attacker's options of constructing successful attacks are significantly reduced, in particular with respect to the use of no-op system calls. For our investigation, we add extra information to two system call-based detection algorithms - one distance-based and one sequence-based - that normally operate on system call names only. We then create two mimicry attacks which avoid detection by the original detectors but are revealed when the extra information is used. Our investigation shows that by providing the extra information to the detector the attacker's options of constructing successful and undetected attacks decreases drastically.



Denna post skapades 2011-03-08. Senast ändrad 2016-06-29.
CPL Pubid: 137711