Anomaly Detection Research Based On System Call Sequence And Arguments

The computer system security issues have become increasingly prominent with the development of the computer network. Anomaly detection technology is receiving more and more attention because of its ability of detecting unknown attacks. Anomaly detection can be divided into network-based and host-based anomaly detection, and this paper mainly discusses anomaly detection based on a particular host which is particularly a server host providing network services on the Internet.A valid monitoring methodology can precisely describe program behavior profile. The system calls are selected as the essential monitoring elements in host-based anomaly detection. The traditional host-based anomaly detection technology detects intrusion by monitoring system call data flow or control flow information. The control-flow anomaly detection system builds various model based on acquired system call sequences according to control-flow analysis. The data-flow anomaly detection system monitors the data transmission between system call arguments and return values. There is still a large gap between control-flow anomaly detection and data-flow anomaly detection which arises the defects of building program behavior profile incompletely and imprecisely.This paper puts forward a new method of combining control flow and data flow analysis. The method adopts fixed length sequence of system calls to build patterns which provides the system call properties context information. With association rule mining techniques, we can find relationships between properties according to the same patterns or different patterns and build two rule sets for the evaluation.At the end of this paper a simulation program based on our model is illustrated. Experimental results show that the control-flow-analysis-aided data flow analysis reveals some more accurate and useful rules that cannot be learned in prior data flow analysis method. These relation rules can be used for detecting more abnormal program behavior.