Intrusion detection using sequences of system calls

Abstract

A method is introduced for detecting intrusions at the level of privileged processes. Evidence is given that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two ways: Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case several types of intrusive behavior were studied; in the latter case, results were analyzed for false positives.

Get full access to this article

View all access options for this article.

References

[8LGM]. [8lgm]-advisory-16.unix.sendmail-6-dec-1994, http://www.8lgm.org/advisories.html.

[8LGM]. [8lgm]-advisory-22.unix.syslog. 2-aug-1995, http://www.8lgm.org/advisories.html.

[8LGM]. [8lgm]-advisory-3.unix.lpr. 19-aug-1991, http://www.8lgm.org/advisories.html.

Anderson,

Frivold and

Valdes, Next-generation intrusion detection expert system (NIDES): A summary. Technical Report SRI–CSL–95–07, Computer Science Laboratory, SRI International, May 1995.

CERT, wuarchive.ftpd vulnerability. ftp://info.cert.org/pub/cert_advisories/CA-93:53.wuarchive.ftpd.vulnerability, 1993.

CERT, Sendmail v.5 vulnerability. ftp://info.cert.org/pub/cert_advisories/CA-95:05.sendmail.vulnerabilities, February 22 1995.

CERT, Sendmail v.5 vulnerability. ftp://info.cert.org/pub/cert_advisories/CA-95:08.sendmail.v.5.vulnerability, August 17 1995.

CERT, Syslog vulnerability – a workaround for sendmail. ftp://info.cert.org/pub/cert_advisories/CA-95:13.syslog.vul, October 19 1995.

CERT, swinstall vulnerability. ftp://info.cert.org/pub/cert_advisories/CA-96:27, December 1996.

10.

Crosbie and

Spafford, Defending a computer system using autonomous agents, in: Proceedings of the 18th National Information Security Systems Conference, 1995.

11.

D.E.

Denning, An intrusion detection model, in: IEEE Transactions on Software Engineering, Los Alamos, CA, IEEE Computer Society Press, 1987.

12.

D.E.

Denning, Cryptography and Data Security, Addison-Wesley Inc., 1992.

13.

Efron and

R.J.

Tibshirani, An Introduction to the Bootstrap, Chapman & Hall, New York, 1993.

14.

Farmer and

Venema, Improving the security of your site by breaking into it, 1995, ftp://ftp.win.tue.nl/pub/security/admin-guide-to-cracking.101.Z, 1995.

15.

Farmer and

E.H.

Spafford, The COPS security checker system, in: Proceedings of the Summer Usenix Conference, June 1990, pp. 165–170.

16.

Forrest,

S.A.

Hofmeyr and

Somayaji, A sense of self for unix processes, in: Proceedings of the 1996 IEEE Symposium on Research in Security and Privacy, Los Alamitos, CA, IEEE Computer Society Press, 1996.

17.

Forrest,

S.A.

Hofmeyr and

Somayaji, Computer immunology, Communications of the ACM 40(10) (1997), 88–96.

18.

Forrest,

Somayaji and

Ackley, Building diverse computer systems, in: Proceedings of the 6th Workshop on Hot Topics in Operating System, Los Alamitos, CA, IEEE Computer Society Press, 1997.

19.

K.L.

Fox,

R.R.

Henning,

J.H.

Reed and

Simonian, A neural network approach towards intrusion detection, in: Proceedings of the 13th National Computer Security Conference, Washington, DC, October 1990, pp. 125–134.

20.

Frank, Artificial intelligence and intrusion detection: Current and future directions, in: Proceedings of the 17th National Computer Security Conference, October 1994.

21.

Heady,

Luger,

Maccabe and

Servilla, The architecture of a network level intrusion detection system. Technical report, Department of Computer Science, University of New Mexico, August 1990.

22.

L.T.

Heberlein,

G.V.

Dias,

K.N.

Levitt,

Mukherjee,

Wood and

Wolber, A network security monitor, in: Proceedings of the IEEE Symposium on Security and Privacy, IEEE Press, 1990.

23.

L.T.

Heberlein,

Mukherjee and

K.N.

Levitt, Internet security monitor: An intrusion detection system for large scale networks, in: Proceedings of the 15th National Computer Security Conference, 1992.

24.

Hochberg,

Jackson,

Stallings,

J.F.

McClary,

DuBois and

Ford, Nadir: An automated system for detecting network intrusion and misuse, Computeres and Security 12(3) (1993), 235–248.

25.

Illgun,

R.A.

Kemmerer and

P.A.

Porras, State transition analysis: A rule-based intrusion detection approach, IEEE Transactions on Software Engineering 3 (1995).

26.

J.O.

Kephart, A biologically inspired immune system for computers, in: Artificial Life IV, MIT Press, 1994.

27.

G.H.

Kim and

E.H.

Spafford, The design and implementation of tripwire: A file system integrity checker, in: Proceedings of the 2nd ACM Conference on Computer and Communications Security, 1994.

28.

Ko,

Fink and

Levitt, Automated detection of vulnerabilities in privileged programs by execution monitoring, in: Proceedings of the 10th Annual Computer Security Applications Conference, 5–9 December 1994, pp. 134–144.

29.

Kumar, Classification and detection of computer intrusions, PhD thesis, Department of Computer Sciences, Purdue University, August 1995.

30.

Kumar and

E.H.

Spafford, A pattern matching model for misuse intrusion detection, in: Proceedings of the National Computer Security Conference, Baltimore, MD, 1994, pp. 11–21.

31.

Liepins and

Vaccaro, Intrusion detection: Its role and validation, Computeres and Security 11 (1992), 247–355.

32.

T.F.

Lunt, Detecting intruders in computer systems, in: Conference on Auditing and Computer Technology, 1993.

33.

T.F.

Lunt,

Tamaru,

Gilham,

Jagannathan,

P.G.

Neumann,

H.S.

Javitz,

Valdes and

T.D.

Garvey, A real-time intrusion detection expert system (IDES). Final Technical Report, Computer Science Laboratory, SRI International, Menlo Park, California, February 1992.

34.

C.L.

Schuba and

E.H.

Spafford, Countering abuse of name-based authentication, in: 22cnd Annual Telecommunications Policy Research Conference, 1996.

35.

S.E.

Smaha and

Winslow, Misuse detection tools, Journal of Computer Security 10(1) (1994), 39–49.

36.

Somayaji,

S.A.

Hofmeyr and

Forrest, Principles of a computer immune system, in: Proceedings of the Second New Security Paradigms Workshop, 1997.

37.

H.S.

Teng,

Chen and

S.C.

Lu, Security audit trail analysis using inductively generated predictive rules, in: Proceedings of the Sixth Conference on Artificial Intelligence Applications, Piscataway, NJ, IEEE, March 1990, pp. 24–29.