Analyzing intrusions using operating system level information flow

摘要: Computers continue to get broken into, so intrusion analysis is a part of most system administrators' job description. System administrators must answer two main questions when analyzing intrusions: "how did the attacker gain access my system?", and "what do after they broke in?". Current tools for intrusions fall short because have insufficient information fully track cannot separate actions attackers from legitimate users. We designed implemented by using OS-level flow highlight activities an attacker. collection causal events which connect operating objects. These can be linked form information-flow graph highlights objects that are attack. Information graphs used help determine how intruder into what compromise. We developed BackTracker system. starts with suspicious object (e.g., malicious process, trojaned executable file) follows attack back in time, events, sequence lead state. Showing these causally-connected provides system-wide view significantly reduces amount data administrator examine order application was originally exploited. also ForwardTracker attacker's exploited tracks forward time display result intrusion. Furthermore, we Bi-directional Distributed (BDB) continues backward across network set computers on local likely been compromised