Intrusion detection via static analysis

By David A. Wagner, Drew Dean. Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001, 2001

795 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/7d2effb29b6c363ddf79a0503a5e36eb7122f384

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

The essence of command injection attacks in web applications (2006, methodology): “Halfond and Orso address SQL injection attacks through first building a model of legal queries and then ensuring that generated queries conform to this model via runtime monitoring [13], following a similar approach to Wagner and Dean’s work on Intrusion Detection Via Static Analysis [8].”
Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis (2009, methodology): “Intuitively, after the matrices are generated offline, the morphing algorithm acts as a proxy between the applications and the network stack, thereby intercepting the data to be sent across the network before headers are calculated or encryption is applied.”
A Virtual Machine Introspection Based Architecture for Intrusion Detection (2003, methodology): “The excellent visibility afforded by host-based architectures has led to the development of a variety of effective techniques for detecting the influence of an attacker, from complex system call trace analysis [19, 26, 50, 52], to integrity checking [22] and log file analysis, to the esoteric method”
Preventing Memory Error Exploits with WIT (2008, background): “The concept of control-flow integrity generalizes the work of Wagner and Dean [41] and was introduced in [28, 6].”
Mining specifications (2002, background): “Wagner and Dean’s intrusion detection system also extracts automaton models, but from source code, not traces [27].”
Mimicry attacks on host-based intrusion detection systems (2002, background): “For this reason, we dub this the mimicry attack [25].”
Effective and Efficient Malware Detection at the End Host (2009, background): “Of course, a significant amount of research has focused on modeling legitimate program behavior by specifying permissible sequences of system calls [18, 48].”
Control-flow integrity principles, implementations, and applications (2009, methodology): “Other CFG intricacies, such as setjmp and longjmp , are addressed using techniques from the programming-languages and the intrusion-detection liter-atures [4, 19, 25, 58].”
User re-authentication via mouse movements (2004, methodology): “Examples of methods that could be applied to monitor a user’s behavior indirectly include those that monitor system call traces [6, 10, 15, 22, 41], audit logs [18, 23, 24, 42, 44], program execution traces [13, 19, 25, 27, 31, 39] and call-stack data analysis [9].”
Behavioural biometrics: a survey and classification (2008, background): “…original work of Hofmeyr et al. (1998) and Warrender et al. (1999) , a number of researchers have pursuit development of security systems based on analysing system call sequences (Ghosh et al., 1999; Giffin et al., 2004; Lam et al., 2006; Marceau, 2000; Nguyen et al., 2003; Wagner and Dean, 2001 ).”
Undermining an Anomaly-Based Intrusion Detection System Using Common Exploits (2002, background): “Wagner and Dean [20] introduced a new class of attacks against intrusion detection systems which they called the “mimicry attack”.”
Defeating script injection attacks with browser-enforced embedded policies (2007, methodology): “Our solution is analogous to a host-based intrusion detection system (HBIDS) [31, 4].”
Improving Host Security with System Call Policies (2003, background): “As a result, evasion attacks [35, 36] are no longer possible.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “In particular, host-based IDS using systemcall monitoring and/or audit logs has been investigated by numerous research efforts [57, 32, 47, 55, 18, 29].”
Non-Control-Data Attacks Are Realistic Threats (2005, result): “The possibility of these attacks has been suggested in previous work [9][42][48][52].”