Anomaly detection using call stack information
- 13 May 2004
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- Vol. 6 (10816011) , 62-75
- https://doi.org/10.1109/secpri.2003.1199328
Abstract
The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from the call stack and effectively using it to detect exploits. In this paper we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate an abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular on what and why attacks will be missed by the various approaches.Keywords
This publication has 7 references indexed in Scilit:
- Using programmer-written compiler extensions to catch security holesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Automated detection of vulnerabilities in privileged programs by execution monitoringPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Mimicry attacks on host-based intrusion detection systemsPublished by Association for Computing Machinery (ACM) ,2002
- Intrusion detection via static analysisPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- A fast automaton-based method for detecting anomalous program behaviorsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Intrusion detection using sequences of system callsJournal of Computer Security, 1998
- Combinatorial pattern discovery in biological sequences: The TEIRESIAS algorithm.Bioinformatics, 1998