Intrusion Detection Using Function-based Sequences of System Calls

• Main Authors: Chun-han Tseng, 曾俊翰
• Other Authors: Meng-feng Tsai
• Format: Others
• Language: en_US
• Published: 2008
• Online Access: http://ndltd.ncl.edu.tw/handle/9u5t6d

碩士 === 國立中央大學 === 資訊工程研究所 === 96 === Computer and network security problems cause billions in damage every year. As the use of Internet, modern computer systems are plagued from security vulnerabilities. Security issues have become more and more important in such environment. Although the concept of buffer overflows had been known for years, modern computer systems suffered from these kinds of security weaknesses constantly. This article presents an improved method for intrusion detection, which detect abnormal behaviors of a process using function-based sequences of system calls. The method is especially effective in detecting Buffer Overflow Attacks. Our method also stored these sequences through a data structure called Suffix Tree, which improved our system performance a lot. Experiments show that our method has better effectiveness and performance than previous methods.