A sense of self for Unix processes

By Stephanie Forrest, S. Hofmeyr, Anil Somayaji, T. Longstaff. 1996

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Poisoning Attacks against Support Vector Machines (2012, methodology): “In fact, learning approaches have already been used or proposed as solutions to a number of such security-sensitive tasks including spam, worm, intrusion and fraud detection (Meyer & Whateley, 2004; Biggio et al., 2010; Stolfo et al., 2003; Forrest et al., 1996; Bolton & Hand, 2002; Cova et al., 201”
Security analysis of online centroid anomaly detection (2010, methodology): “Detection is carried out by computing the distance of a new example x from the centroid c and comparing it with an appropriate threshold: f(x) = { 1, if ||x− c|| > θ 0, otherwise.”
A Learning-Based Approach to the Detection of SQL Attacks (2005, unknown): “For example, in [9] and [23] sequence analysis is applied to system calls produced by speciﬁc applications in order to identify “normal” system call sequences for a certain application.”
Immune system approaches to intrusion detection – a review (2004, methodology): “[105] aimed to build an IDS based on an explicit notion of self within a computer system (see Figure 1).”
Anagram: A Content Anomaly Detector Resistant to Mimicry Attack (2006, methodology): “Forrest [16]’s "foreign sequences of system calls" in a binary-based anomaly detector is quite similar to the modeling implemented in Anagram.”
Detecting Novel Network Intrusions Using Bayes Estimators (2001, background): “Forrest et al.[7] record frequent subsequences of system call that are invoked in the execution of a program.”
Automated Response Using System-Call Delay (2000, methodology): “Although research IDSs have performed anomaly detection for years [1, 27, 17, 16], most commercial systems emphasize misuse detection (i.”
A genetic programming approach to automated software repair (2009, background): “Many techniques are available for identifying bugs in programs, both statically (e.g., [7, 16]) and dynamically (e.g., [14, 17, 20]).”
Robust Anomaly Detection Using Support Vector Machines (2003, methodology): “Forrest et al. introduced the idea of building program proﬁles with short sequences of system calls issued by running programs for intrusion detection [15].”
Intrusion detection via static analysis (2001, methodology): “Most intrusion detection systems (IDS) are based on one of two methodologies: either they generate a model of a program’s or system’s behavior from observing its behavior on known inputs (e.g., [14]), or they require the generation of a rule base (e.g., [3]).”
Basic concepts and taxonomy of dependable and secure computing (2004, methodology): “Intrusion detection is usually performed via likelihood checks [18], [15].”
Hiding Intrusions: From the Abnormal to the Normal and Beyond (2002, background): “Note that the true external penetrator may be either an outsider with no connection to the organization that owns or controls the system being attacked or it may be someone associated with the organization who is not authorized to use the system.”
Outlier Analysis (2013, methodology): “Some examples of such methods include counting mismatches among lookahead pairs [164], and a length-sensitive recursive computation of subsequence similarity [284, 285].”
Detecting Unknown Network Attacks Using Language Models (2006, background): “Previous results in natural language processing and host-based IDS indicate that the optimal n-gram length may vary for different applications (39; 19; 24).”