期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

Intrusion Detection Method for Program Vulnerability via Library Calls 被引量：1

Intrusion Detection Method for Program Vulnerability via Library Calls
下载PDF
导出
摘要 Library function call sequence is the direct reflection of a program＇s behavior. The relationship between program vulnerability and library calls is analyzed, and an intrusion detection method via library calls is proposed, in which the short sequences of library call are used as signature profile. In this intrusion detection method, library interposition is used to hook library calls, and with the discussion of the features of the library call sequence in detail, an algorithm based on information-theory is applied to determine the appropriate length of the library call sequence. Experiments show good performance of our method against intrusions caused by the popular program vulnerabilities. Library function call sequence is the direct reflection of a program＇s behavior. The relationship between program vulnerability and library calls is analyzed, and an intrusion detection method via library calls is proposed, in which the short sequences of library call are used as signature profile. In this intrusion detection method, library interposition is used to hook library calls, and with the discussion of the features of the library call sequence in detail, an algorithm based on information-theory is applied to determine the appropriate length of the library call sequence. Experiments show good performance of our method against intrusions caused by the popular program vulnerabilities.
作者 DUAN Xuetao ZHONG Anming LI Ying JIA Chunfu
机构地区 College of Information Technology and Science College of Information Science and Technology
出处 《Wuhan University Journal of Natural Sciences》 CAS 2007年第1期126-130,共5页 武汉大学学报（自然科学英文版）
基金 Supported by the Science and Technology Development Project Foundation of Tianjin (033800611, 05YFGZGX24200)
关键词 intrusion detection program vulnerability library call information entropy intrusion detection program vulnerability library call information entropy
分类号 G251 [文化科学—图书馆学]
  • 相关文献

参考文献10

  • 1Forrests S,,Steven A H.A Sense of Self for UNIX Processes[].Proceedings of the IEEE Symposium on Security and Privacy.1996
  • 2Jones M B.Interposition Agents: Transparently Interposing User Code at the System Interface[].Proceedings of the th Symposium on Operating Systems Principles.1993
  • 3Jones A K,,Yu L.Application Intrusion Detection Using Language Library Calls[].Proceeding of th Annual Computer Security Applications Conference.2001
  • 4Viega J,,Bloch J T,Kohno Y, et al.A Static Vulnerability Scanner for C and C++ Code[].Proceedings of the th Annual Computer Security Applications Conference.2000
  • 5Cowan C,Beattie S,Johansen J,et al.PointGuard: Protecting Pointers from Buffer Overflow Vulnerabilities[].Proceedings of th USENIX Security Symposium.2003
  • 6Cowan C,,Pu C,Maier D.Stack-Guard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks C][].Proceedings of the th USENIX Security Conference.1998
  • 7Curry T W.Profiling and Tracing Dynamic Library Usage via Interposition[].USENIX Summer TechnicalConference.1994
  • 8Kuperman B A,,Spafford E.Generation of Application Level Audit Data via Library Interposition[]..1999
  • 9Lee W,,Dong X.Information-Theoretic Measures for Anomaly Detection[].Proceedings of the IEEE Symposium on Security and Privacy.2001
  • 10Steven A H,,Stephanie F,Anil S.Intrusion Detection Using Sequences of System Calls[].Journal of Computer Security.1998

同被引文献4

  • 1Forrest S, Hofmeyr A. A Sense of Self for Unix Processes[C]// Proceedings of 1996 IEEE Symposium on Security and Privacy. Oakland, USA: IEEE Press, 1996.
  • 2Anita K, Yu Lin. Application Intrusion Detection Using Language Library Calls[C]//Proc. of the 17th Annual Computer Security Applications Conference. New Orleans, USA: IEEE Press, 2001.
  • 3Warrender C, Forest S. Detection Intrusion Using System Calls: Alternative Data Models[C]//Proceedings of 1999 IEEE Symposium on Security and Privacy. Oakland, USA: IEEE Press, 1999.
  • 4Forrest S. Computer Immune Systems[EB/OL]. (2008-12-12). http:// www.cs.unm.edu/-immsec/data/SM/CERT/.

引证文献1

Wuhan University Journal of Natural Sciences
2007年 第1期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部