Sciweavers

Share
RAID
2001
Springer

Accurately Detecting Source Code of Attacks That Increase Privilege

10 years 3 months ago
Accurately Detecting Source Code of Attacks That Increase Privilege
Host-based Intrusion Detection Systems (IDS) that rely on audit data exhibit a delay between attack execution and attack detection. A knowledgeable attacker can use this delay to disable the IDS, often by executing an attack that increases privilege. To prevent this we have begun to develop a system to detect these attacks before they are executed. The system separates incoming data into several categories, each of which is summarized using feature statistics that are combined to estimate the posterior probability that the data contains attack code. Our work to date has focused on detecting attacks embedded in shell code and C source code. We have evaluated this system by constructing large databases of normal and attack software written by many people, selecting features and training classifiers, then testing the system on a disjoint corpus of normal and attack code. Results show that such attack code can be detected accurately.
Robert K. Cunningham, Craig S. Stevenson
Added 30 Jul 2010
Updated 30 Jul 2010
Type Conference
Year 2001
Where RAID
Authors Robert K. Cunningham, Craig S. Stevenson
Comments (0)
books