Sciweavers

Share
RAID
2009
Springer

Automatically Adapting a Trained Anomaly Detector to Software Patches

12 years 4 months ago
Automatically Adapting a Trained Anomaly Detector to Software Patches
Abstract. In order to detect a compromise of a running process based on it deviating from its program’s normal system-call behavior, an anomaly detector must first be trained with traces of system calls made by the program when provided clean inputs. When a patch for the monitored program is released, however, the system call behavior of the new version might differ from that of the version it replaces, rendering the anomaly detector too inaccurate for monitoring the new version. In this paper we explore an alternative to collecting traces of the new program version in a clean environment (which may take effort to set up), namely adapting the anomaly detector to accommodate the differences between the old and new program versions. We demonstrate that this adaptation is feasible for such an anomaly detector, given the output of a state-of-the-art binary difference analyzer. Our analysis includes both proofs of properties of the adapted detector, and empirical evaluation of adapted de...
Peng Li, Debin Gao, Michael K. Reiter
Added 27 May 2010
Updated 27 May 2010
Type Conference
Year 2009
Where RAID
Authors Peng Li, Debin Gao, Michael K. Reiter
Comments (0)
books