Understanding Precision in Host Based Intrusion Detection

摘要: Many host-based anomaly detection systems monitor process execution at the granularity of system calls. Other recently proposed schemes instead verify destinations control-flow transfers to prevent attack code. This paper formally analyzes and compares real based on these two philosophies in terms their capabilities, proves disproves several intuitions. We prove that for any system-call sequence model, under same (static or dynamic) program analysis technique, there always exists a more precise model. While hybrid approaches combining calls control flows intuitively seem advantageous, especially when binary constructs incomplete models, we they have no fundamental advantage over simpler models. Finally, utilize ideas our framework make external monitoring feasible level. Our experiments show imposes performance overhead comparable previous call while detecting synthetic world attacks as effectively an inlined monitor.