Intrusion detection using sequences of system calls

Article type: Research Article

Authors: Hofmeyr, Steven A.^{; *} | Forrest, Stephanie | Somayaji, Anil

Affiliations: Department of Computer Science, University of New Mexico, Albuquerque, NM 87131-1386, USA. E-mail: steveah@cs.unm.edu, forrest@cs.unm.edu, soma@cs.unm.edu

Correspondence: [*] Corresponding author.

Abstract: A method is introduced for detecting intrusions at the level of privileged processes. Evidence is given that short sequences of system calls executed by running processes are a good discriminator between normal and abnormal operating characteristics of several common UNIX programs. Normal behavior is collected in two ways: Synthetically, by exercising as many normal modes of usage of a program as possible, and in a live user environment by tracing the actual execution of the program. In the former case several types of intrusive behavior were studied; in the latter case, results were analyzed for false positives.

DOI: 10.3233/JCS-980109

Journal: Journal of Computer Security, vol. 6, no. 3, pp. 151-180, 1998