Lightweight intrusion detection for networked operating systems
| Citations: | 2 - 0 self |
BibTeX
@MISC{Hofmeyr_lightweightintrusion,
author = {Steven A. Hofmeyr and Stephanie Forrest and Anil Somayaji},
title = {Lightweight intrusion detection for networked operating systems},
year = {}
}
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
We describe a method for intrusion detection at the level of privileged processes. We present evidence that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two ways: Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case we study several types of intrusive behavior; in the latter case, we analyze our results for false positives. 1.
