Automated Response Using System-Call Delay

By Anil Somayaji, Stephanie Forrest. USENIX Security Symposium, 2000

309 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/15fa2be1a377a505d017c586f0dcf7e966e69b6f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Casting out Demons: Sanitizing Training Data for Anomaly Sensors (2008, background): “We are, however, currently investigating two additional sensors: one based on libanomaly and one based on the pH system [22].”
Adaptive Anomaly Detection via Self-calibration and Dynamic Updating (2009, background): “pH [ 24 ]). Despite the best efforts of the research community, no AD sensor has been proposed to date that can detect all attack types while maintaining a low alert rate.”
Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis (2009, methodology): “The morphing algorithm refers to the appropriate morphing matrix for the source process, and pads the data (or splits it into several smaller packets) according to the matrix.”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, methodology): “Independently, Wagner and Soto [2002] have also developed mimicry attacks against a sequence-based IDS called pH proposed by Somayaji and Forrest [2000]. Using the machinery of finite automata, they construct a framework for testing whether an IDS is susceptible to mimicry for a particular exploit.”
Detecting energy-greedy anomalies and mobile malware variants (2008, methodology): “, enumerating sequences [26, 47], ngram vectors [15], data-mining techniques [28], Bayesian classification [35], neural networks [34], finite-state automata [43], and hidden Markov models [54].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, background): “stems are not well-suited to APTs. Detectors dependent on malware signatures are blind to attacks that exploit new vulnerabilities [20]. Anomaly-based systems typically analyze series of system calls [114] and log-adjacent system events [130], but most of them [36], [81], [92], [109] have difﬁculty ”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “The attack is tested against the pH IDS [Somayaji and Forrest 2000], by modifying the autowx attack script exploit.”
Throttling viruses: restricting propagation to defeat malicious mobile code (2002, background): “Other related work by [1] suggests ways to limit machines so that they cannot participate in network attacks, and [14] give an example of benign responses used in an intrusion detection application.”