Application intrusion detection using language library calls

摘要: Traditionally, intrusion detection systems detect intrusions at the operating system (OS) level. We explore possibility of detecting application level by using rich semantics. use short sequences language library calls as signatures. consider call signatures to be more application-oriented than because they are a direct reflection code. Most applications written in higher-level with an associated support such C or C++. hypothesize that can used attacks cause perturbation hopeful this technique will amenable carried out internal intruders, who viewed legitimate users system.