Long-Span Program Behavior Modeling and Attack Detection

Xiaokui Shu

doi:10.1145/3105761

Long-Span Program Behavior Modeling and Attack Detection

2017-09-20

23

OA

AI

DOI：10.1145/3105761

查看原文

摘要

En 中文

Intertwined developments between program attacks and defenses witness the evolution of program anomaly detection methods. Emerging categories of program attacks, e.g., non-control data attacks and data-oriented programming, are able to comply with normal trace patterns at local views. This article points out the deficiency of existing program anomaly detection models against new attacks and presents long-span behavior anomaly detection (LAD), a model based on mildly context-sensitive grammar verification. The key feature of LAD is its reasoning of correlations among arbitrary events that occurred in long program traces. It extends existing correlation analysis between events at a stack snapshot, e.g., paired call and ret, to correlation analysis among events that historically occurred during the execution. The proposed method leverages specialized machine learning techniques to probe normal program behavior boundaries in vast high-dimensional detection space. Its two-stage modeling/detection design analyzes event correlation at both binary and quantitative levels. Our prototype successfully detects all reproduced real-world attacks against sshd, libpcre, and sendmail. The detection procedure incurs 0.1 ms to 1.3 ms overhead to profile and analyze a single behavior instance that consists of tens of thousands of function call or system call events.

Keyword:

Intrusion detection

program analysis

anomaly detection

context-sensitive grammar

co-occurrence analysis

event frequency correlation

machine learning

Long-Span Program Behavior Modeling and Attack Detection

摘要

AI总结

期刊

机构

引用论文