Gray-Box Extraction of Execution Graphs for Anomaly Detection

• المؤلفون الرئيسيون: GAO, Debin, Reiter, Michael K., SONG, Dawn
• التنسيق: text
• اللغة: English
• منشور في: Institutional Knowledge at Singapore Management University 2004
• الموضوعات: Information Security
• الوصول للمادة أونلاين: https://ink.library.smu.edu.sg/sis_research/1242; http://dx.doi.org/10.1145/1030083.1030126
• المؤسسة: Singapore Management University

Many host-based anomaly detection systems monitor a process by observing the system calls it makes, and comparing these calls to a model of behavior for the program that the process should be executing. In this paper we introduce a new model of system call behavior, called an execution graph. The ex...