A probabilistic method for detecting anomalous program behavior

Authors:
Kohei Tatara;Toshihiro Tabata;Kouichi Sakurai
Affiliations:
Graduate School of Information Science and Electrical Engineering, Kyushu University, Japan;Faculty of Information Science and Electrical Engineering, Kyushu University, Japan;Faculty of Information Science and Electrical Engineering, Kyushu University, Japan
Venue:
WISA'04 Proceedings of the 5th international conference on Information Security Applications
Year:
2004

Citing 11
Cited 0

Characterizing the behavior of a program using multiple-length N-grams

Proceedings of the 2000 workshop on New security paradigms
Mimicry attacks on host-based intrusion detection systems

Proceedings of the 9th ACM conference on Computer and communications security
Intrusion Detection via System Call Traces

IEEE Software
Using Text Categorization Techniques for Intrusion Detection

Proceedings of the 11th USENIX Security Symposium
"Why 6?" Defining the Operational Limits of Stide, an Anomaly-Based Intrusion Detector

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Temporal Signatures for Intrusion Detection

ACSAC '01 Proceedings of the 17th Annual Computer Security Applications Conference
A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Intrusion Detection via Static Analysis

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Information-Theoretic Measures for Anomaly Detection

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Intrusion detection using sequences of system calls

Journal of Computer Security
A sense of self for Unix processes

SP'96 Proceedings of the 1996 IEEE conference on Security and privacy

Quantified Score

Hi-index	0.04

Visualization

Abstract

In this paper, we, as well as Eskin, Lee, Stolfo [7] propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N–1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.