Using system call information to reveal hidden attack manifestations
Konferensbidrag (offentliggjort, men ej förlagsutgivet), 2010

We investigate how system call-based intrusion detectors can be made more resistant against mimicry attacks. We show that by including extra information such as system call arguments, return values, and identity of the user responsible for the calls, the attacker's options of constructing successful attacks are significantly reduced, in particular with respect to the use of no-op system calls. For our investigation, we add extra information to two system call-based detection algorithms - one distance-based and one sequence-based - that normally operate on system call names only. We then create two mimicry attacks which avoid detection by the original detectors but are revealed when the extra information is used. Our investigation shows that by providing the extra information to the detector the attacker's options of constructing successful and undetected attacks decreases drastically.

Författare

Ulf Larson

Chalmers, Data- och informationsteknik, Nätverk och system

Dennis Nilsson

Chalmers, Data- och informationsteknik, Datorteknik

Erland Jonsson

Chalmers, Data- och informationsteknik, Nätverk och system

S. Lindskog

Norges teknisk-naturvitenskapelige universitet

Proceedings of the 1st International Workshop on Security and Communication Networks, IWSCN 2009

5683048

Ämneskategorier

Data- och informationsvetenskap

ISBN

978-829971051-0