Host-based intrusion detection system for secure human-centric computing

Abstract

With the advancement of information communication technology, people can access many useful services for human-centric computing. Although this advancement increases work efficiency and provides greater convenience to people, advanced security threats such as the Advanced Persistent Threat (APT) attack have been continuously increasing. Technical measures for protecting against an APT attack are desperately needed because APT attacks, such as the 3.20 Cyber Terror and SK Communications hacking incident, have occurred repeatedly and cause considerable damage, socially and economically. Moreover, there are limitations of the existing security devices designed to cope with APT attacks that continue persistently using zero-day malware. For this reason, we propose a malware detection method based on the behavior information of a process on the host PC. Our proposal overcomes the limitations of the existing signature-based intrusion detection systems. First, we defined 39 characteristics for demarcating malware from benign programs and collected 8.7 million characteristic parameter events when malware and benign programs were executed in a virtual-machine environment. Further, when an executable program B Daesung Moon daesung@etri.re.kr Sung Bum Pan 123 D. Moon et al.is running on a host PC, we present the behavior information as an 83-dimensional vector by reconstructing the frequency of each characteristic parameter's occurrence according to the process ID for the collected characteristic parameter data. It is possible to present more accurate behavior information by including the frequency of characteristic parameter events occurring in child processes. We use a C4.5 decision tree algorithm to detect malware in the database. The results of our proposed method show a 2.0 % false-negative detection rate and a 5.8 % false-positive detection rate.

User, Usage and Usability: Redefining Human Centric Cyber Security

“…A myriad of applications and technology resources exist that focus particularly on the continuous dissemination of information to users. These technological advancements provide users with convenience and offer corporations high-level business efficiency ( Moon et al, 2015 ). However, not all information is presented in layman terms.…”

“…This is possible because the computing environments are connected to networks everywhere. However, the important information available in these environments may equally always be vulnerable to malicious intrusion ( Moon et al, 2015 ). To cope with cyber attacks, companies use network security equipment such as firewalls, intrusion detection systems, intrusion prevention systems, and security technologies such as antivirus software and data-loss protection.…”

Analyzing host security using D‐S evidence theory and multisource information fusion

“…This model warns users of malicious activities found in the environment by tracking and analyzing system calls. Moon et al 43 proposed a malware detection method based on process behavior information. By collecting the characteristic parameter values of the process ID, the frequency of occurrence of each characteristic parameter was analyzed, and malware was classified based on the frequency information.…”

An optimization detection algorithm for complex intrusion interference signal in mobile wireless network

“…It has higher approximation ability, and its continuity is the best. When the control factor µ increases or decreases, the curve of the new threshold function becomes steeper and smooth [3,13].…”