Anomaly detection using call stack information

By Henry Hanping Feng, Oleg M. Kolesnikov, Prahlad Fogla, Wenke Lee, W. Gong. 2003 Symposium on Security and Privacy, 2003., 2003

443 citations recorded by the source corpus.

The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from the call stack and effectively using it to detect exploits. In this paper we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate an abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular on what and why attacks will be missed by the various approaches.

Subfields: Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c02cca40eb3f7af976f8c77007ded81d72592013

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “For example, [85] incorporates into the analysis information about the call stack configuration at the time of a system call to counteract mimicry attacks.”
Non-Control-Data Attacks Are Realistic Threats (2005, background): “…[9] and address-space randomization [4][6]; and others rely on control flow integrity for security, such as system call based intrusion detection techniques [17][18][19][21][22][23][34][47], control data protection techniques [10][35][42], and nonexecutable-memory-based protections [1][41].”
Behavioural biometrics: a survey and classification (2008, background): “A number of representation schemas for the behavioural model have been proposed, including strings (Warrender et al., 1999; Wespi et al., 2000), finite state automata and push down automata (Feng et al., 2003; Giffin, et al., 2004).”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “In particular, host-based IDS using systemcall monitoring and/or audit logs has been investigated by numerous research efforts [57, 32, 47, 55, 18, 29].”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “System call sequences for intrusion and anomaly detection [92]–[98] are an especially popular alter-”
User re-authentication via mouse movements (2004, methodology): “Examples of methods that could be applied to monitor a user’s behavior indirectly include those that monitor system call traces [6, 10, 15, 22, 41], audit logs [18, 23, 24, 42, 44], program execution traces [13, 19, 25, 27, 31, 39] and call-stack data analysis [9].”
Detecting energy-greedy anomalies and mobile malware variants (2008, background): “The proflle describes the normal behavior (e.g., users, hosts, applications, or network connections) [ 22 , 56].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, background): “VtPath [36] extended this idea to avoid the impossible path problem, in which there may exist sequences of state transitions in the FSA that cannot happen in practice.”
Backdoors in Neural Models of Source Code (2020, background): “These works typically target specific classes of bugs, high-level architectural flaws [26], and in many cases use dynamic execution traces [17, 22].”