Sciweavers

SP
2003
IEEE

Anomaly Detection Using Call Stack Information

13 years 9 months ago
Anomaly Detection Using Call Stack Information
The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from call stack and effectively using it to detect exploits. In this paper, we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular, on what and why attacks will be missed by the various approaches.
Henry Hanping Feng, Oleg M. Kolesnikov, Prahlad Fo
Added 05 Jul 2010
Updated 05 Jul 2010
Type Conference
Year 2003
Where SP
Authors Henry Hanping Feng, Oleg M. Kolesnikov, Prahlad Fogla, Wenke Lee, Weibo Gong
Comments (0)