Customized Normalcy Profiles for the Detection of Targeted Attacks
نویسندگان
چکیده
Functionality is the highest semantic level of the software behavior pyramid that reflects goals of the software rather than its specific implementation. Detection of malicious functionalities presents an effective way to detect malware in behavior-based IDS. A technology for mining system call data, discussed herein, results in the detection of functionalities representing operation of legitimate software within a closed network environment. The set of such functionalities combined with the frequencies of their execution constitutes a normalcy profile typical for this environment. Detection of deviations from this normalcy profile, new functionalities and/or changes in the execution frequencies, provides evidence of abnormal activity in the network caused by malware. This approach could be especially valuable for the detection of targeted zeroday attacks. The paper presents the results of the implementation and testing of the described technology on the computer network testbed.
منابع مشابه
Intrusion Detection in Wireless Sensor Networks using Genetic Algorithm
Wireless sensor networks, due to the characteristics of sensors such as wireless communication channels, the lack of infrastructure and targeted threats, are very vulnerable to the various attacks. Routing attacks on the networks, where a malicious node from sending data to the base station is perceived. In this article, a method that can be used to transfer the data securely to prevent attacks...
متن کاملMoving dispersion method for statistical anomaly detection in intrusion detection systems
A unified method for statistical anomaly detection in intrusion detection systems is theoretically introduced. It is based on estimating a dispersion measure of numerical or symbolic data on successive moving windows in time and finding the times when a relative change of the dispersion measure is significant. Appropriate dispersion measures, relative differences, moving windows, as well as tec...
متن کاملEvaluation of an Intrusion Detection System for Routing Attacks in Wireless Self-organised Networks
Wireless Sensor Networks (WSNs) arebecoming increasingly popular, and very useful in militaryapplications and environmental monitoring. However,security is a major challenge for WSNs because they areusually setup in unprotected environments. Our goal in thisstudy is to simulate an Intrusion Detection System (IDS)that monitors the WSN and report intrusions accurately andeffectively. We have thus...
متن کاملTheoretical and Computational Evaluation of the Use of Molecular Nanoelectronic Technology in Targeted Monitoring of Electrical Brain Waves to Predict Some Neuro-cerebral Attacks
Abstract Background and Objectives: Today, it is expected that by using molecular nanoelectronic, the symptoms emitted from neurons will be studied. Many studies show that abnormalities in the normal functioning of brain cells can lead to neurological attacks. One of the most common brain system defects is epileptic seizures. In this case, due to the electrical discharge of a group of neurons,...
متن کاملF-STONE: A Fast Real-Time DDOS Attack Detection Method Using an Improved Historical Memory Management
Distributed Denial of Service (DDoS) is a common attack in recent years that can deplete the bandwidth of victim nodes by flooding packets. Based on the type and quantity of traffic used for the attack and the exploited vulnerability of the target, DDoS attacks are grouped into three categories as Volumetric attacks, Protocol attacks and Application attacks. The volumetric attack, which the pro...
متن کامل