Using system call information to reveal hidden attack manifestations
Conference contribution, 2010

We investigate how system call-based intrusion detectors can be made more resistant against mimicry attacks. We show that by including extra information such as system call arguments, return values, and identity of the user responsible for the calls, the attacker's options of constructing successful attacks are significantly reduced, in particular with respect to the use of no-op system calls. For our investigation, we add extra information to two system call-based detection algorithms - one distance-based and one sequence-based - that normally operate on system call names only. We then create two mimicry attacks which avoid detection by the original detectors but are revealed when the extra information is used. Our investigation shows that by providing the extra information to the detector the attacker's options of constructing successful and undetected attacks decreases drastically.

Author

Ulf Larson

Chalmers, Computer Science and Engineering (Chalmers), Networks and Systems (Chalmers)

Dennis Nilsson

Chalmers, Computer Science and Engineering (Chalmers), Computer Engineering (Chalmers)

Erland Jonsson

Chalmers, Computer Science and Engineering (Chalmers), Networks and Systems (Chalmers)

S. Lindskog

Norwegian University of Science and Technology (NTNU)

Proceedings of the 1st International Workshop on Security and Communication Networks, IWSCN 2009

5683048

Subject Categories

Computer and Information Science

ISBN

978-829971051-0

More information

Latest update

4/20/2018