Hidden processes: The implication for intrusion detection

IEEE Systems, Man and Cybernetics Society Information Assurance Workshop

Volumn , Issue , 2003, Pages 116-121

  Butler, J ^a   Undercoffer, J L ^a   Pinkston, J ^a  

^a University of Marylandw Baltimore County   (United States)

Author keywords

Computer architecture; Computer crime; Internet; Intrusion detection; Kernel; Operating systems; Security; Software engineering; Software systems

Indexed keywords

COMPUTER ARCHITECTURE; COMPUTER CRIME; CYBERNETICS; INTERNET; INTRUSION DETECTION; MERCURY (METAL); NETWORK ARCHITECTURE; SOFTWARE ENGINEERING; TRANSFER FUNCTIONS;

COMPUTING ARCHITECTURE; INTRUSION DETECTION SYSTEMS; KERNEL; NETWORK CONNECTION; OPERATING SYSTEM FUNCTIONS; REPORTING FUNCTIONS; SECURITY; SOFTWARE SYSTEMS;

COMPUTER OPERATING SYSTEMS;

EID: 84946403333     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SMCSIA.2003.1232409     Document Type: Conference Paper

References (23)

1. CERT/CC, "Cert/cc statistics 1988-2002," http://www.cert.org/, October 2002.
2. Frank Kargle, Joerm Maier, and Michael Weber, "Protecting web servers from distributed denial of service attacks," Proceeding of the Tenth International World Wide Web Conference, 2001.
3. Dorothy E. Denning, Information Warfare and Security, Addison Wesley, 2001.
4. Jeffrey Undercoffer and John Pinkston, "Modeling computer attacks: A target-centric ontology for intrusion detection," Tech. Rep. TR CS 02-169, University of Maryland, Baltimore County, December 2002.
5. Paul J. Criscuolo, "Distributed denial of service," Tech. Rep. CIAC-2319, Lawrence Livermore National Laboratory, February 2000.
6. Bob Toxen, Real World Linux Security, Prentice Hall, 1999.
7. Lee Sutterfield, "Annual computer security conference and exhibition," http://www.press.securelogic.com/events.html, Speech by Lee Sutterfield to the Computer Security Institute.
8. Stephanie Forrest, Steven A. Hofmeyr, Anil Somayaji, and Thomas Longstaff, "A sense of self for unix processes," in 1996 IEEE Symposium on Security and Privacy. 1996, pp. 120-128, IEEE Computer Society Press.
9. Anil Somayaji and Stephanie Forrest, "Automated response using system-call delays," in Proceedings of the Ninth USENIX Security Symposium, August 2000, pp. 120-128.
10. Christina Warrender, Stephanie Forrest, and Barak Pearlmutter, "Detecting intrusion using system calls: Alternative data models," in 1999 IEEE Symposium on Security and Privacy. 1999, pp. 133-145, IEEE Computer Society Press.
11. Frank Apap, Andrew Honig, Shlomo Hershkop, Eleazar Eskin, and Sal Stolfo, "Detecting malicious software by monitoring anomalous windows registry accesses," in Fifth International Symposium - Recent Advances in Intrusion Detection, A. Wespi, G. Vigna, and L. Deri, Eds. 2002, number 2516 in LNCS, pp. 37-53, Springer.
12. Nelson Murilo and Klaus Steding-Jessen, "chkrootkit version 0.37," www.chkrootkit.org, September 2002.
13. FuSyS, "Kstat," http://s0ftpj.org/en/site.html, KSTAT for Linux.
14. Stealth, "Adore," http://teso.scene.at/releases/adore-0.42.tgz, The Adore Root Kit.
15. Dark-Angel, "Phantasmagoria," http://online.securityfocus.com/archive/1/290724.
16. Gene H. Kim and Eugene H. Spafford, "The design and implementation of tripwire: A file system integrity checker," in ACM Conference on Computer and Communications Security, 1994, pp. 18-29.
17. W. Richard Steves, Unix Network Programming: Networking APIs: Sockets and XTI, vol. One, Prentice Hall,, second edition, 1998.
18. Galen Hunt and Doug Brubacher, "Detours: Binary interception of win32 fucntions," in Proceedings of the Third USENIX Windows NT Symposium, 1999.
19. Shaun Clowes, "Injectso 0.2," http://www.securereality.com.au, 2002, Tool for injecting shared libraries into running processes.
20. William Wulf, "Statement before the House Science Committee, U.S. House of Representatives," October 10 2001.
21. James R. Butler, "Detecting compromises of core subsystems and kernel fucntions in windows nt/2000/xp," M.S. thesis, University of Maryland, Baltimore County, 2002.
22. William A. Arbaugh, D. J. Farber, and J. M. Smith, "A secure and reliable bootstrap architecture," in IEEE Symposium on Security and Privacy, 1997, pp. 65-71.
23. Tom Mitchell, Machine Learning, WCB McGraw-Hill, 1997.