A gray-box DPDA-based intrusion detection technique using system-call monitoring

J.H. Jafarian, A. Abbasi, S.S. Sheikhabadi

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

2 Citations (Scopus)

Abstract

In this paper, we present a novel technique for automatic and efficient intrusion detection based on learning program behaviors. Program behavior is captured in terms of issued system calls augmented with point-of-system-call information, and is modeled according to an efficient deterministic pushdown automaton (DPDA). The frequency of visit of each state is captured and statistically analyzed to detect abnormal execution patterns. This approach provides a very accurate learning of program behavior, which avoids a broad class of impossible path exploits. It also allows detection of new classes of attacks such as denial-of-service and brute-force dictionary attacks. We also present a complexity analysis of our model, and show that its time and space complexity is polynomial and fairly comparable to other similar approaches in learning, and hugely better in detection. Moreover, We evaluate our approach experimentally in terms of false positive rate, convergence rate, and performance. Finally, We shall discuss classes of attacks which are detectable and undetectable by our approach.
Original languageEnglish
Title of host publicationCEAS'11 : Proceedings of the 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, 1-2 September 2011, Perth, Australia
Place of PublicationNew York
PublisherAssociation for Computing Machinery, Inc
Pages1-12
Number of pages12
ISBN (Print)978-1-4503-0788-8
DOIs
Publication statusPublished - 2011
Externally publishedYes
Event8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS 2011), September 1-2, 2011, Perth, Australia - Perth, Australia
Duration: 1 Sep 20112 Sep 2011

Publication series

NameCEAS '11
PublisherACM

Conference

Conference8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS 2011), September 1-2, 2011, Perth, Australia
Abbreviated titleCEAS 2011
CountryAustralia
CityPerth
Period1/09/112/09/11

Fingerprint

Dive into the research topics of 'A gray-box DPDA-based intrusion detection technique using system-call monitoring'. Together they form a unique fingerprint.

Cite this