Detecting intrusions using system calls: alternative data models

By Christina E. Warrender, Stephanie Forrest, Barak A. Pearlmutter. 1999

Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. We study one such observable-sequences of system calls into the kernel of an operating system. Using system-call data sets generated by several different programs, we compare the ability of different data modeling methods to represent normal behavior accurately and to recognize intrusions. We compare the following methods: simple enumeration of observed sequences; comparison of relative frequencies of different sequences; a rule induction technique; and hidden Markov models (HMMs). We discuss the factors affecting the performance of each method and conclude that for this particular problem, weaker methods than HMMs are likely sufficient.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Security analysis of online centroid anomaly detection (2010, methodology): “The centroid anomaly detection is a very simple method which has been widely used in computer security applications (e.g., Forrest et al., 1996; Warrender et al., 1999; Wang and Stolfo, 2004; Rieck and Laskov, 2006; Wang et al., 2006; Rieck and Laskov, 2007).”
Detecting Unknown Network Attacks Using Language Models (2006, methodology): “In the ensuing work these ideas were extended through application of Hidden Markov Models (21), feed-forward and recursive neural networks (23), rule induction algorithms (47) and Support Vector Machines (14).”
Hiding Intrusions: From the Abnormal to the Normal and Beyond (2002, background): “…data, a nontrivial process that is discussed in [8] which establishes a evaluation framework that focuses on the structure of anomalous sequences and provides a means to describe the interaction between the anomalous sequences and the sliding window of anomaly detection algorithms like stide.”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, background): “…[e.g., Newsome et al., 2005, Stolfo et al., 2003, 2004], host-based intrusion detection systems (HIDS) [e.g., Forrest et al., 1996, Hofmeyr et al., 1998, Mutz et al., 2006, Somayaji and Forrest, 2000, Warrender et al., 1999], and other types of fraud detection [cf., Bolton and Hand, 2002].”
Detecting energy-greedy anomalies and mobile malware variants (2008, methodology): “, enumerating sequences [26, 47], ngram vectors [15], data-mining techniques [28], Bayesian classification [35], neural networks [34], finite-state automata [43], and hidden Markov models [54].”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Anomaly detection IDS systems use various machine learning and statistical techniques to determine whether a program is performing atypical operations [17], [8], [23], [49], [29], [43], but are often prone to false positives [5], [21], [47].”
Information-theoretic measures for anomaly detection (2001, methodology): “In several recent studies, learning-based approaches were applied to build anomaly detection models using system call data of privileged programs [6, 7, 14, 28].”
Robust Anomaly Detection Using Support Vector Machines (2003, methodology): “A generative approach (e.g., [6]) builds a model solely based on normal training examples and evaluates each testing case to see how well it ﬁts the model.”
A Learning-Based Approach to the Detection of SQL Attacks (2005, background): “For example, in [9] and [23] sequence analysis is applied to system calls produced by speciﬁc applications in order to identify “normal” system call sequences for a certain application.”
Comprehensive approach to intrusion detection alert correlation (2004, background): “Index Terms—Intrusion detection, alert correlation, alert reduction, correlation data sets.”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “There is potentially a wide disparity in the sizes and underlying NIDS and firewall software running in these networks, and extensions to provide support for DOMINO would be implemented as plug-ins for these systems.”
A hybrid intrusion detection system design for computer network security (2009, background): “Anomaly detection based intrusion detection systems are separated into many sub-categories in the literature including statistical methodologies [7–10], data mining [11,12], artificial neural networks [13], genetic algorithms [14] and immune systems [15,16].”
A fast automaton-based method for detecting anomalous program behaviors (2001, methodology): “[30] studies four different algorithms for learning program behaviors.”
Generation of a new IDS test dataset: Time to retire the KDD collection (2013, unknown): “A discussion of these results is conducted in Section V, with concluding remarks in Section VI.”
Forecasting: theory and practice (2020, background): “In intrusion detection systems, on the other hand, anomalies in system events might indicate a possible breach of security (Warrender et al., 1999).”