Of daemons and men: A file system approach towards intrusion detection

Graphical abstractProposed IDS architecture. Binary audit data are BSM audit records in our implementation. Display Omitted HighlightsA new feature space for modelling users' behaviour as observed from the file system.Decision engine can be based on both simple (GMM) and complex (SVM) classifiers.High detection rates and low corresponding false positive rates.Real world web servers used for training and evaluating the system.Malicious data set was built based on the findings of our honeynet. We present FI2DS a file system, host based anomaly detection system that monitors Basic Security Module (BSM) audit records and determines whether a web server has been compromised by comparing monitored activity generated from the web server to a normal usage profile. Additionally, we propose a set of features extracted from file system specific BSM audit records, as well as an IDS that identifies attacks based on a decision engine that employs one-class classification using a moving window on incoming data. We have used two different machine learning algorithms, Support Vector Machines (SVMs) and Gaussian Mixture Models (GMMs) and our evaluation is performed on real-world datasets collected from three web servers and a honeynet. Results are very promising, since FI2DS detection rates range between 91% and 95.9% with corresponding false positive rates ranging between 8.1×10-2% and 9.3×10-4%. Comparison of FI2DS to another state-of-the-art filesystem-based IDS, FWRAP, indicates higher effectiveness of the proposed IDS in all three datasets. Within the context of this paper FI2DS is evaluated for the web daemon user; nevertheless, it can be directly extended to model any daemon-user for both intrusion detection and postmortem analysis.