PROBE: a process behavior-based host intrusion prevention system

Authors:
Minjin Kwon;Kyoochang Jeong;Heejo Lee
Affiliations:
Department of Computer Science and Engineering, Korea University, Seoul, Korea;Department of Computer Science and Engineering, Korea University, Seoul, Korea;Department of Computer Science and Engineering, Korea University, Seoul, Korea
Venue:
ISPEC'08 Proceedings of the 4th international conference on Information security practice and experience
Year:
2008

Citing 7
Cited 0

Computer immunology

Communications of the ACM
A Sense of Self for Unix Processes

SP '96 Proceedings of the 1996 IEEE Symposium on Security and Privacy
Polygraph: Automatically Generating Signatures for Polymorphic Worms

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Behavior-based spyware detection

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
Intrusion detection using sequences of system calls

Journal of Computer Security
Detecting and displaying novel computer attacks with Macroscope

IEEE Transactions on Systems, Man, and Cybernetics, Part A: Systems and Humans

Quantified Score

Hi-index	0.00

Visualization

Abstract

Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5% false-positive and 5% false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.