An Improved Intrusion Detecting Method Based on Process Profiling

情報処理学会 Web Site 被引用文献3件 参考文献20件

書誌事項

タイトル別名
  • Improved Intrusion Detecting Method Based on Process Profiling

この論文をさがす

抄録

There have been two well-known models for host based intrusion detection.They are called Anomaly Intrusion Detection (AID) model andMisuse Intrusion Detection (MID) model.The former model analyzes user behavior and the statistics of a processin normal situation and it checks whether the system is being used in a different manner.The latter model maintains database of known intrusion technique anddetects intrusion by comparing a behavior against the database.An intrusion detection method based on an AID model can detect a newintrusion method however it needs to update the data describing users behaviorand the statistics in normal usage. We call these information profiles.There are several problems in AID to be addressed.The profiles are tend to be large.Detecting intrusion needs a large amount of system resource likeCPU time and memory and disk space.An MID model requires less amount of system resource to detect intrusion.However it cannot detect new unknown intrusion methods.Our method solves these problems by recording system calls from daemon processes and setuid programs.We have further improved the method to eliminate false positive intrusion detections by adopting a DP matching scheme.

There have been two well-known models for host based intrusion detection.They are called Anomaly Intrusion Detection (AID) model andMisuse Intrusion Detection (MID) model.The former model analyzes user behavior and the statistics of a processin normal situation,and it checks whether the system is being used in a different manner.The latter model maintains database of known intrusion technique anddetects intrusion by comparing a behavior against the database.An intrusion detection method based on an AID model can detect a newintrusion method, however it needs to update the data describing users behaviorand the statistics in normal usage. We call these information profiles.There are several problems in AID to be addressed.The profiles are tend to be large.Detecting intrusion needs a large amount of system resource, likeCPU time and memory and disk space.An MID model requires less amount of system resource to detect intrusion.However it cannot detect new, unknown intrusion methods.Our method solves these problems by recording system calls from daemon processes and setuid programs.We have further improved the method to eliminate false positive intrusion detections by adopting a DP matching scheme.

収録刊行物

被引用文献 (3)*注記

もっと見る

参考文献 (20)*注記

もっと見る

キーワード

詳細情報 詳細情報について

問題の指摘

ページトップへ