Application-based anomaly intrusion detection with dynamic information flow analysis

Masri, Wes; Podgurski, Andy

doi:10.1016/j.cose.2008.06.002

Cited by 26 publications

(14 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our experiments, we explore four of its documented vulnerabilities, exhibiting JSP source code disclosure (vulnerability 1), directory listing disclosure (vulnerability 2), and JSP engine denial of service (vulnerabilities 3 and 4). Details on these vulnerabilities could be found in [22]. The total test suite used for this application consists of 658 requests, 460 of which are safe, while the rest are unsafe, exploiting one of the four vulnerabilities.…”

Section: Preliminary Resultsmentioning

confidence: 99%

Intrusion detection using signatures extracted from execution profiles

El-Ghali

Masri

2009

2009 ICSE Workshop on Software Engineering for Secure Systems

Self Cite

View full text Add to dashboard Cite

An application based intrusion detection system is a security mechanism designed to detect malicious behavior that could compromise the security of a software application. Our aim is to develop such a system that operates on signatures extracted from execution profiles. These signatures are not descriptions of exploits, but instead are descriptions of the program conditions that lead to the exploitation of software vulnerabilities, i.e., they depend on the structure of the vulnerabilities themselves.A program vulnerability is generally induced by the execution of a combination of program statements. In this work we first analyze the execution profiles of a subject application in order to identify such suspicious combinations and consequently extract and define their corresponding signatures. Then, we insert probes in select locations in the application to enable online signature matching.To evaluate our technique, we implemented it for Java programs and applied it on Tomcat 3.0 in order to detect well-known attacks. Our results were promising, as no false negatives and a maximum of 4.5% false positives were observed, and the runtime overhead was less than 5%.

show abstract

Section: Preliminary Resultsmentioning

confidence: 99%

Intrusion detection using signatures extracted from execution profiles

El-Ghali

Masri

2009

2009 ICSE Workshop on Software Engineering for Secure Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…Specifically, given test sets comprising passing and failing test cases, we measure the effectiveness of a given technique at isolating the failing test cases from the passing cases. The findings of this study are not only relevant to software testing [3] [4] [16] [12], but also to other software analyses that apply cluster analysis to execution profiles [11] [15] [16]. For example, Podgurski et al [18] applied cluster analysis and stratified sampling onto execution profiles to enhance the effectiveness of software reliability estimation.…”

Section: Introductionmentioning

confidence: 82%

Isolating failing test cases: A comparative experimental study of clustering techniques

Farjo

Masri

Hajj

2013

2013 Third International Conference on Communications and Information Technology (ICCIT)

Self Cite

View full text Add to dashboard Cite

Researchers have applied cluster analysis onto execution profiles induced by test cases in order to solve problems in the area of software testing and analysis. The employed clustering techniques varied, and no study was conducted to rate these techniques in terms of their effectiveness in this specific domain. This work aims at doing so experimentally. Specifically, given test sets comprising passing and failing test cases, we measure the performance of each technique at isolating the failing test cases from the passing cases. The study included one technique from each of the six main families of clustering algorithms. Our results suggested the following ranking of the evaluated techniques from best to worst: DBSCAN, K-Means, Agglomerative-AGNES and WaveCluster, Fuzzy-FCM, and K-Subspace.

show abstract

“…We use dynamic detection methods to determine current states of the user [12]. For example: if the computer detects that a user leaves for some time, it will turns off the screen automatically to save power.…”

Section: System Architecture and Scenariosmentioning

confidence: 99%

Mobile Computer System with User Friendly Environment and Security Protection

Lin

Liu

et al. 2012

2012 Sixth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing

View full text Add to dashboard Cite

In this paper, motion detection with the webcam can determine current conditions around mobile computers, which act accordingly with a variety of response methods. A good balance is achieved between sensitivity of machines and experiences of users. Many practical applications are investigated, and this paper is primarily focused on two main points: user-friendly operations and security. Our system provides dynamic detection features for suspicious objects: photos of suspected thieves are taken, saved, and uploaded to the Internet, and when necessary, warning Short Message Service messages are sent to mobile phone users. Apart from this application, many other applications are feasible, for example, connection of alternative current power cords of laptops can be used to determine whether they are at a risk of being stolen.

show abstract

Application-based anomaly intrusion detection with dynamic information flow analysis

Cited by 26 publications

References 25 publications

Intrusion detection using signatures extracted from execution profiles

Intrusion detection using signatures extracted from execution profiles

Isolating failing test cases: A comparative experimental study of clustering techniques

Mobile Computer System with User Friendly Environment and Security Protection

Contact Info

Product

Resources

About