Syscall-BSEM: Behavioral semantics enhancement method of system call sequence for high accurate and robust host intrusion detection

2021 ◽  
Author(s):  
Yifei Zhang ◽  
Senlin Luo ◽  
Limin Pan ◽  
Hanqing Zhang
Keyword(s):  
Intrusion Detection ◽  
System Call ◽  
Enhancement Method ◽  
Call Sequence

An Anomaly Intrusion Detection Based on Hidden Markov Model System Call Sequenc

2011 ◽  
Vol 225-226 ◽  
pp. 609-613
Author(s):  
Dong Liang Wang ◽  
Zhi Gang Wang
Keyword(s):  
Intrusion Detection ◽  
Markov Model ◽  
Hidden Markov Model ◽  
Hidden Markov ◽  
Research Progress ◽  
Detection Accuracy ◽  
System Call ◽  
Building Model ◽  
Anomaly Intrusion Detection ◽  
Call Sequence

To improve detection accuracy, Utilizing HMM (Hidden Markov model) and BW to building model, the detection accuracy improves greatly. First, the research progress of intrusion detection is recalled, then the model based on Markov and BW is presented. An example of using system call trace data which is used in intrusion detection, is given to illustrate the performance of this model. Finally, comparison of detection ability between the above detection method and others is given. It is found that the IDS based on HMM System Call sequence has improve the accuracy greatly.

Taint Graph of System Call Arguments for Intrusion Detection in Mobile Intelatrac

2012 ◽  
Vol 546-547 ◽  
pp. 1101-1106
Author(s):  
Dan Nie ◽  
Yu Hui Wang
Keyword(s):  
Intrusion Detection ◽  
Control Flow ◽  
System Call ◽  
Mobile Telecommunication ◽  
Control Data ◽  
Critical Data ◽  
Buffer Overflows ◽  
System Calls ◽  
Flow Information ◽  
Behavior Profile

The intended data-flow in a vulnerable program is subject to be subverted by attacks which exploit buffer overflows or format string vulnerabilities to write data to unintended location. In Mobile Telecommunication it is especially important on data safety. These attacks can be classified into two types: control-flow-attacks exploit buffer overflows or other vulnerabilities to overwrite a return address, a function pointer, or some other piece of control-data; non-control-data attacks exploit similar vulnerabilities to overwrite security critical data without subverting the intended control-flow in the program. The control-flow attacks are well studied and widely used, so there are several typical approaches to prevent them, which monitor the sequence of system calls emitted by the application being monitored and utilize control-flow information of the system calls for intrusion detection. However, the non-control-data attacks are rare for the reason that they rely on specific semantics of the target applications, and there are only few works that defend them to some extent. In order to prevent non-control-data attacks, we leverage dynamic taint technique to track the instruction level relationship between different system call arguments and construct taint graph which can represent behavior profile of a benign program in this paper..

Research on Dynamic Intrusion Detection Model Based on Risk Coefficient

2010 ◽  
Vol 129-131 ◽  
pp. 124-127 ◽  
Author(s):  
Zheng Wei ◽  
Jun Yi Hou ◽  
Hua Tan ◽  
Guang Nan Guo
Keyword(s):  
Intrusion Detection ◽  
Detection Method ◽  
System Call ◽  
Security Technology ◽  
Detection Model ◽  
Risk Coefficient ◽  
Detection Technology ◽  
System Risk ◽  
Effectiveness And Efficiency ◽  
Definition Of

Intrusion detection technology is a kind of network security technology that can protect system from attacks. Based on the definition of system call risk coefficient, the paper brought out a system risk coefficient based dynamic intrusion detection model. Using the model, the drawbacks of traditional intrusion detection method based on system call was solved, which speeds up detection process and decreased false rate and error rate. It can also effectively identify error operations or users. The experiment result also proves the effectiveness and efficiency of the method.

Sign in / Sign up

Export Citation Format

Share Document