Host-based intrusion detection system for secure human-centric computing

摘要: With the advancement of information communication technology, people can access many useful services for human-centric computing. Although this increases work efficiency and provides greater convenience to people, advanced security threats such as Advanced Persistent Threat (APT) attack have been continuously increasing. Technical measures protecting against an APT are desperately needed because attacks, 3.20 Cyber Terror SK Communications hacking incident, occurred repeatedly cause considerable damage, socially economically. Moreover, there limitations existing devices designed cope with attacks that continue persistently using zero-day malware. For reason, we propose a malware detection method based on behavior process host PC. Our proposal overcomes signature-based intrusion systems. First, defined 39 characteristics demarcating from benign programs collected 8.7 million characteristic parameter events when were executed in virtual-machine environment. Further, executable program is running PC, present 83-dimensional vector by reconstructing frequency each parameter's occurrence according ID data. It possible more accurate including occurring child processes. We use C4.5 decision tree algorithm detect database. The results our proposed show 2.0 % false-negative rate 5.8 false-positive rate.