Publication Type

Conference Proceeding Article

Version

acceptedVersion

Publication Date

9-2011

Abstract

Anomaly detection has been attracting interests from researchers due to its advantage of being able to detect zero-day exploits. A gray-box anomaly detector first observes benign executions of a computer program and then extracts reliable rules that govern the normal execution of the program. However, such observations from benign executions are not necessarily true evidences supporting the rules learned. For example, the observation that a file descriptor being equal to a socket descriptor should not be considered supporting a rule governing the two values to be the same. Ground truthing such observations is a difficult problem since it is not practical to analyze the semantics of every instruction in every program to be protected. In this paper, we propose using taint analysis to automatically help the ground truthing. Intuitively, the same taint source of two values provides ground truth of the data dependence. We implement a host-based anomaly detector with our proposed taint tracking and evaluate the accuracy of rules learned. Results show that we not only manage to filter out incorrect rules that would otherwise be learned (with high support and confidence), but manage recover good rules that are previously believed to be unreliable. We also present overheads of our system and time needed for training.

Keywords

anomaly detection, taint analysis, system call monitor, ground truthing

Discipline

Information Security

Research Areas

Cybersecurity

Publication

2011 5th International Conference on Network and System Security (NSS): Milan, Italy, September 6-8: Proceedings

First Page

1

Last Page

8

ISBN

9781457704604

Identifier

10.1109/ICNSS.2011.6059956

Publisher

IEEE

City or Country

Piscataway, NJ

Copyright Owner and License

Authors

Additional URL

https://doi.org/10.1109/ICNSS.2011.6059956

Download

Share

COinS