Efficient intrusion detection based on static analysis and stack walks

Jingyu Hua, Mingchu Li, Kouichi Sakurai, Yizhi Ren

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Some intrusion detection models such as the VPStatic first construct a behavior model for a program via static analysis, and then perform intrusion detection by monitoring whether its execution is consistent with this behavior model. These models usually share the highly desirable feature that they do not produce false alarms but they face the conflict between precision and efficiency. The high precision of the VPStatic is at the cost of high space complexity. In this paper, we propose a new context-sensitive intrusion detection model based on static analysis and stack walks, which is similar to VPStatic but much more efficient, especially in memory use. We replace the automaton in the VPStatic with a state transition table (STT) and all redundant states and transitions in VPStatic are eliminated. We prove that our STT model is a deterministic pushdown automaton (DPDA) and the precision is the same as the VPStatic. Experiments also demonstrate that our STT model reduces both time and memory costs comparing with the VPStatic, in particular, memory overheads are less than half of the VPStatic's. Thereby, we alleviate the conflict between precision and efficiency.

Original languageEnglish
Title of host publicationAdvances in Information and Computer Security - 4th International Workshop on Security, IWSEC 2009, Proceedings
Pages158-173
Number of pages16
DOIs
Publication statusPublished - 2009
Event4th International Workshop on Security, IWSEC 2009 - Toyama, Japan
Duration: Oct 28 2009Oct 30 2009

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume5824 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other4th International Workshop on Security, IWSEC 2009
CountryJapan
CityToyama
Period10/28/0910/30/09

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Efficient intrusion detection based on static analysis and stack walks'. Together they form a unique fingerprint.

Cite this