A fast automaton-based method for detecting anomalous program behaviors

By R. Sekar, Mangesh Bendre, Dinakar Dhurjati, Pradeep Bollineni. Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001, 2001

649 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/47a77932347be19e1a8fb24cadd74a8a43a387f3

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Anomaly detection using call stack information (2003, methodology): “We also developed techniques to handle some implementation issues that were not adequately addressed in [16], us-ing techniques that are much simpler than those described in [17].”
Anomaly detection: A survey (2009, methodology): “The authors also apply their technique to operating system call intrusion detection [Sekar et al. 2001].”
Non-Control-Data Attacks Are Realistic Threats (2005, background): “…[9] and address-space randomization [4][6]; and others rely on control flow integrity for security, such as system call based intrusion detection techniques [17][18][19][21][22][23][34][47], control data protection techniques [10][35][42], and nonexecutable-memory-based protections [1][41].”
Control-flow integrity principles, implementations, and applications (2009, background): “CFI is also related to a line of research on intrusion detection where a security policy for a program is derived from an inspection of the program itself or its executions [6, 18, 19, 21, 24, 25, 31, 48, 58, 59].”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “System call sequences for intrusion and anomaly detection [92]–[98] are an especially popular alter-”
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage (2019, background): “[57] further added more complex structures such as loops and branches in the syscall sequences.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “Host-based intrusion detection techniques mainly fall into three categories: (1) misuse-based, which rely on specifications of bad behaviors associated with known attacks; (2) anomaly-based [19, 32, 47, 20, 30, 11, 48], which rely on learning a model of benign behavior and detecting deviations from ”
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, background): “Host-based intrusion detection approaches fall under three classes: (1) misuse-based [32], [47], which detect behavior associated with known attacks; (2) anomaly-based [13], [16], [17], [31], [35], [40], [49], [51], which learn a model of benign behavior and detect deviations from it; and (3) specif”
Learning nonstationary models of normal network traffic for detecting novel attacks (2002, background): “More recent work has focused on better models, such as state machines [17], or neural networks [6].”
Detecting energy-greedy anomalies and mobile malware variants (2008, methodology): “, enumerating sequences [26, 47], ngram vectors [15], data-mining techniques [28], Bayesian classification [35], neural networks [34], finite-state automata [43], and hidden Markov models [54].”
Network traffic anomaly detection based on packet bytes (2003, neutral): “We de5cr16e a tw0 5ta9e an0ma1y detect10n 5y5tem f0r 1dent1fy1n9 5u5p1c10u5 traff1c.”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, background): “Anomaly-based systems typically analyze series of system calls [114] and log-adjacent system events [130], but most of them [36, 81, 92, 109] have difficulty modeling long-term behavior patterns.”