Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring (1994)
| Venue: | In Proceedings of the 10th Annual Computer Security Applications Conference |
| Citations: | 104 - 4 self |
BibTeX
@INPROCEEDINGS{Ko94automateddetection,
author = {Calvin Ko and George Fink and Karl Levitt},
title = {Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring},
booktitle = {In Proceedings of the 10th Annual Computer Security Applications Conference},
year = {1994},
pages = {134--144}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
We present a method for detecting exploitations of vulnerabilities in privileged programs by monitoring their execution using audit trials, where the monitoring is with respect to specifications of the security-relevant behavior of the programs. Our work is motivated by the intrusion detection paradigm, but is an attempt to avoid ad hoc approaches to codifying misuse behavior. Our approach is based on the observation that although privileged programs can be exploited (due to errors) to cause security compromise in systems because of the privileges accorded to them, the intended behavior of privileged programs is, of course, limited and benign. The key, then is to specify the intended behavior (i.e., the program policy) and to detect any action by privileged program that is outside the intended behavior and that imperils security. We describe a program policy specification language, which is based on simple predicate logic and regular expressions. In addition, we present specifications ...
