FLIPS: Hybrid adaptive intrusion prevention (2005)
Cached
Download Links
- [www1.cs.columbia.edu]
- [www.cs.dartmouth.edu]
- DBLP
Other Repositories/Bibliography
| Venue: | In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID |
| Citations: | 40 - 14 self |
BibTeX
@INPROCEEDINGS{Locasto05flips:hybrid,
author = {Michael E. Locasto and Ke Wang and Angelos D. Keromytis and Salvatore J. Stolfo},
title = {FLIPS: Hybrid adaptive intrusion prevention},
booktitle = {In Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID},
year = {2005},
pages = {82--101}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract. Intrusion detection systems are fundamentally passive and fail–open. Because their primary task is classification, they do nothing to prevent an attack from succeeding. An intrusion prevention system (IPS) adds protection mechanisms that provide fail–safe semantics, automatic response capabilities, and adaptive enforcement. We present FLIPS (Feedback Learning IPS), a hybrid approach to host security that prevents binary code injection attacks. It incorporates three major components: an anomaly-based classifier, a signature-based filtering scheme, and a supervision framework that employs Instruction Set Randomization (ISR). Since ISR prevents code injection attacks and can also precisely identify the injected code, we can tune the classifier and the filter via a learning mechanism based on this feedback. Capturing the injected code allows FLIPS to construct signatures for zero-day exploits. The filter can discard input that is anomalous or matches known malicious input, effectively protecting the application from additional instances of an attack – even zero-day attacks or attacks that are metamorphic in nature. FLIPS does not require a known user base and can be deployed transparently to clients and with minimal impact on servers. We describe a prototype that protects HTTP servers, but FLIPS can be applied to a variety of server and client applications.
Citations
No citations identified.
