Formalizing sensitivity in static analysis for intrusion detection
- 10 June 2004
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- Vol. 2578 (10816011) , 194-208
- https://doi.org/10.1109/secpri.2004.1301324
Abstract
A key function of a host-based intrusion detection system is to monitor program execution. Models constructed using static analysis have the highly desirable feature that they do not produce false alarms; however, they may still miss attacks. Prior work has shown a trade-off between efficiency and precision. In particular, the more accurate models based upon pushdown automata (PDA) are very inefficient to operate due to non-determinism in stack activity. In this paper, we present techniques for determinizing PDA models. We first provide a formal analysis framework of PDA models and introduce the concepts of determinism and stack-determinism. We then present the VP-Static model, which achieves determinism by extracting information about stack activity of the program, and the Dyck model, which achieves stack-determinism by transforming the program and inserting code to expose program state. Our results show that in run-time monitoring, our models slow execution of our test programs by 1% to 135%. This shows that reasonable efficiency needs not be sacrificed for model precision. We also compare the two models and discover that deterministic PDA are more efficient, although stack-deterministic PDA require less memory.Keywords
This publication has 12 references indexed in Scilit:
- Anomaly detection using call stack informationPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2004
- Detecting intrusions using system calls: alternative data modelsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- A sense of self for Unix processesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Automated detection of vulnerabilities in privileged programs by execution monitoringPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Mimicry attacks on host-based intrusion detection systemsPublished by Association for Computing Machinery (ACM) ,2002
- Intrusion detection via static analysisPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- A fast automaton-based method for detecting anomalous program behaviorsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Bro: a system for detecting network intruders in real-timeComputer Networks, 1999
- Temporal sequence learning and data reduction for anomaly detectionACM Transactions on Information and System Security, 1999
- Adaptive real-time anomaly detection using inductively generated sequential patternsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1990