There have been two well-known models for host based intrusion detection. They are called Anomaly Intrusion Detection (AID) model and Misuse Intrusion Detection (MID) model. The former model analyzes user behavior and the statistics of a process in normal situation, and it checks whether the system is being used in a different manner. The latter model maintains database of known intrusion technique and detects intrusion by comparing a behavior against the database. An intrusion detection method based on an AID model can detect a new intrusion method, however it needs to update the data describing users behavior and the statistics in normal usage. We call these information profiles. There are several problems in AID to be addressed. The profiles are tend to be large. Detecting intrusion needs a large amount of system resource, like CPU time and memory and disk space. An MID model requires less amount of system resource to detect intrusion. However it cannot detect new, unknown intrusion methods. Our method solves these problems by recording system calls from daemon processes and setuid programs. We have further improved the method to eliminate false positive intrusion detections by adopting a DP matching scheme.
[1]
Elizabeth D. Zwicky,et al.
Building Internet firewalls (2nd ed.)
,
2000
.
[2]
Elizabeth D. Zwicky,et al.
Building internet firewalls
,
1995
.
[3]
Stephanie Forrest,et al.
A sense of self for Unix processes
,
1996,
Proceedings 1996 IEEE Symposium on Security and Privacy.
[4]
Dorothy E. Denning,et al.
An Intrusion-Detection Model
,
1986,
1986 IEEE Symposium on Security and Privacy.
[5]
Barak A. Pearlmutter,et al.
Detecting intrusions using system calls: alternative data models
,
1999,
Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344).
[6]
Stephanie Forrest,et al.
Intrusion Detection Using Sequences of System Calls
,
1998,
J. Comput. Secur..
[7]
Shigeki Goto,et al.
A new intrusion detection method based on discriminant analysis
,
2001
.
[8]
Todd L. Heberlein,et al.
Network intrusion detection
,
1994,
IEEE Network.
[9]
Mike Kosta Loukides.
System Performance Tuning
,
1990
.