Formulation of a Heuristic Rule for Misuse and Anomaly Detection for U2R Attacks in Solaris Operating System Environment

This paper proposes a heuristic rule for detection of user-to-root (U2R) attacks against Solaris TM operating system. Relevant features for developing heuristic rules were manually mined using Solaris TM Basic Security Module audit data. The proposed rule was tested on both DARPA 1998 and 1999 intrusion detection datasets. Results show that all user-to-root attacks exploiting the suid program were detected with 100% probability and with zero false alarms. The rule can detect both successful and unsuccessful U2R attempts against the Solaris TM operating system. The proposed rule is general enough to detect any U2R attack that leverages the buffer overflow technique. Empirical results indicate that the rule also detected novel user-to-root attacks in DARPA 1998 intrusion detection dataset. Hence the rule has the potential and can be used for anomaly detection.