Efficient Context-Sensitive Intrusion Detection Based on State Transition Table
| Autor: | Jingyu Hua, Mingchu Li, Kouichi Sakurai, Yizhi Ren |
|---|---|
| Rok vydání: | 2011 |
| Předmět: |
Signal processing
Computer science Applied Mathematics Real-time computing Context (language use) Intrusion detection system Construct (python library) Static analysis computer.software_genre Computer Graphics and Computer-Aided Design Feature (computer vision) Signal Processing Data mining Electrical and Electronic Engineering computer Host (network) State transition table |
| Zdroj: | IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences. :255-264 |
| ISSN: | 1745-1337 0916-8508 |
| DOI: | 10.1587/transfun.e94.a.255 |
| Popis: | Those host-based intrusion detection models like VPStatic first construct a model of acceptable behaviors for each monitored program via static analysis, and then perform intrusion detection by comparing them with programs' runtime behaviors. These models usually share the highly desirable feature that they do not produce false alarms but face the conflicts between accuracy and efficiency. For instance, the high accuracy of the VPStatic model is at the cost of high space complexity. In this paper, we use a statically-constructed state transition table (STT), which records expected transitions among system calls as well as their stack states (return address lists), as a behavior model to perform context-sensitive intrusion detection. According to our analysis, our STT model improves the space efficiency of the VPStatic model without decreasing its high precision and time efficiency. Experiments show that for three test programs, memory uses of our STT models are all much less than half of the VPStatic models'. Thereby, we alleviate the conflicts between the accuracy and the efficiency. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|