Title

Behavioral Distance for Intrusion Detection

Publication Type

Conference Proceeding Article

Publication Date

9-2005

Abstract

We introduce a notion, behavioral distance, for evaluating the extent to which processes—potentially running different programs and executing on different platforms—behave similarly in response to a common input. We explore behavioral distance as a means to detect an attack on one process that causes its behavior to deviate from that of another. We propose a measure of behavioral distance and a realization of this measure using the system calls emitted by processes. Through an empirical evaluation of this measure using three web servers on two different platforms (Linux and Windows), we demonstrate that this approach holds promise for better intrusion detection with moderate overhead.

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

8th International Symposium on Recent Advances in Intrusion Detection (RAID 2005)

Volume

3858

First Page

63

Last Page

81

ISBN

9783540317791

Identifier

10.1007/11663812_4

Publisher

Springer Verlag

City or Country

Seattle, WA, USA

Additional URL

http://dx.doi.org/10.1007/11663812_4