Loading...
Please wait, while we are loading the content...
Similar Documents
Anomaly detection using call stack information (2003)
| Content Provider | CiteSeerX |
|---|---|
| Author | Feng, Henry Hanping Fogla, Prahlad Kolesnikov, Olegm. Gong, Weibo |
| Description | In Proceedings of the 2003 IEEE Symposium on Security and Privacy |
| Abstract | The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from call stack and effectively using it to detect exploits. In this paper, we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular, on what and why attacks will be missed by the various approaches. 1 |
| File Format | |
| Publisher Date | 2003-01-01 |
| Access Restriction | Open |
| Subject Keyword | Abstract Execution Path Anomaly Detection Various Approach Good Information Source Basic Idea Return Address Call Stack Information Program Execution Program Execution Point Underlying Principle False Positive Performance Call Stack |
| Content Type | Text |
| Resource Type | Proceeding |
