Intrusion detection using sequences of system calls

By S. Hofmeyr, Stephanie Forrest, Anil Somayaji. 1998

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Security analysis of online centroid anomaly detection (2010, methodology): “It has been successfully used in a variety of anomaly detection applications such as intrusion detection (Hofmeyr et al., 1998; Yeung and Chow, 2002; Laskov et al., 2004a; Wang and Stolfo, 2004; Rieck and Laskov, 2006; Wang et al., 2006; Rieck and Laskov, 2007), wireless sensor networks…”
Behavioural biometrics: a survey and classification (2008, background): “Following the original work of Hofmeyr et al. (1998) and Warrender et al. (1999) , a number of researchers have pursuit development of security systems based on analysing system call sequences (Ghosh et al., 1999; Giffin et al., 2004; Lam et al., 2006; Marceau, 2000; Nguyen et al., 2003; Wagner and…”
Outlier Detection for Temporal Data: A Survey (2014, methodology): “Rather than looking for exact matches, if a sub-sequence is not in the database, soft mismatch scores can also be computed [20], [61]–[63].”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “Analysis of system call is pioneered by Forrest and Hofmeyr in the 1990s [51], [69].”
Detecting intrusions using system calls: alternative data models (1999, methodology): “The original studies of the system-call approach were conducted primarily on synthetic data sets 2 [4, 13, 7, 6].”
Anomaly detection: A survey (2009, methodology): “These calls could be generated by programs [Hofmeyr et al. 1998] or by users [Lane and Brodley 1999].”
Anomaly Detection for Discrete Sequences: A Survey (2012, methodology): “In particular, several techniques have been developed to detect anomalies in operating system call data [4], [5], [6], [7], [8], [9], [10].”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Anomaly detection IDS systems use various machine learning and statistical techniques to determine whether a program is performing atypical operations [17], [8], [23], [49], [29], [43], but are often prone to false positives [5], [21], [47].”
A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection (2003, methodology): “An approach for modeling normal sequences using look ahead pairs and contiguous sequences is presented in [13].”
An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, background): “Their work was extended by Hofmeyr et al. [24], where they collected a database of normal behavior for each program of interest.”
Outlier Analysis (2013, methodology): “Combination outliers typically use windowing techniques in which comparison units are extracted from the sequence for the purposes of analysis [163, 222].”
The monitoring and early detection of Internet worms (2005, unknown): “For example, the “IDES” [13], “NIDES” [5] and “eBayes” [39] from SRI International; the anomaly intrusion detection method [15] based on “sequences”