Using Program Behavior Pro les for Intrusion Detection

Intrusion detection and response has traditionally been performed at the network and host levels That is intrusion monitors will typically analyze network packet logs or host machine audit logs for signs of intrusion activity More often than not commercial o the shelf COTS intrusion detection tools use ngerprints of known intrusions to detect their presence in these audit trails Both these approaches employed by most state of the practice tools have their drawbacks In this paper we describe a method for program based intrusion detection that is aimed at detecting novel attacks against systems