Behavioral Distance for Intrusion Detection
Publication Type
Conference Proceeding Article
Publication Date
9-2005
Abstract
We introduce a notion, behavioral distance, for evaluating the extent to which processes—potentially running different programs and executing on different platforms—behave similarly in response to a common input. We explore behavioral distance as a means to detect an attack on one process that causes its behavior to deviate from that of another. We propose a measure of behavioral distance and a realization of this measure using the system calls emitted by processes. Through an empirical evaluation of this measure using three web servers on two different platforms (Linux and Windows), we demonstrate that this approach holds promise for better intrusion detection with moderate overhead.
Discipline
Information Security
Research Areas
Information Security and Trust
Publication
8th International Symposium on Recent Advances in Intrusion Detection (RAID 2005)
Volume
3858
First Page
63
Last Page
81
ISBN
9783540317791
Identifier
10.1007/11663812_4
Publisher
Springer Verlag
City or Country
Seattle, WA, USA
Citation
GAO, Debin; Reiter, Michael K.; and SONG, Dawn.
Behavioral Distance for Intrusion Detection. (2005). 8th International Symposium on Recent Advances in Intrusion Detection (RAID 2005). 3858, 63-81.
Available at: https://ink.library.smu.edu.sg/sis_research/1243
Additional URL
http://dx.doi.org/10.1007/11663812_4