Automated Caching of Behavioral Patterns for Efficient Run-Time Monitoring

Run-time monitoring is a powerful approach for dynamically detecting faults or malicious activity of software systems. However, there are often two obstacles to the implementation of this approach in practice: (1) that developing correct and/or faulty behavioral patterns can be a difficult, labor-intensive process, and (2) that use of such pattern-monitoring must provide rapid turn-around or response time. We present a novel data structure, called extended action graph, and associated algorithms to overcome these drawbacks. At its core, our technique relies on effectively identifying and caching specifications from (correct/faulty) patterns learnt via machine-learning algorithm. We describe the design and implementation of our technique and show its practical applicability in the domain of security monitoring of sendmail software.

• Type: Conference
• Year: 2006
• Where: DASC
• Authors: Natalia Stakhanova, Samik Basu, Robyn R. Lutz, Johnny Wong
• Keywords: Applied Computing, DASC 2006, Extended Action Graph, Faulty Behavioral Patterns, Run-time Monitoring