Analysis of Computer Intrusions Using Sequences of Function Calls

Peisert, Sean; Bishop, Matt; Karin, Sidney; Marzullo, Keith
 
Dependable and Secure Computing, IEEE Transactions on, Vol.5, Iss.2,
April-June 2007

Pages:137-150

Abstract: This paper demonstrates the value of analyzing sequences of
function calls for forensic analysis. Although this approach has been used
for intrusion detection (that is, determining that a system has been
attacked), its value in isolating the cause and effects of the attack has
not previously been shown. We also look for not only the presence of
unexpected events but also the absence of expected events. We tested these
techniques using reconstructed exploits in su, ssh, and lpr, as well as
proof-of-concept code, and, in all cases, were able to detect the anomaly
and the nature of the vulnerability.

URL:
http://ieeexplore.ieee.org.ezproxy.auckland.ac.nz/iel5/8858/4198171/04198178
.pdf?isnumber=4198171&prod=JNL&arnumber=4198178&arnumber=4198178&arSt=137&ar
ed=150&arAuthor=Peisert%2C+Sean%3B+Bishop%2C+Matt%3B+Karin%2C+Sidney%3B+Marz
ullo%2C+Keith