The Evolution of System-Call Monitoring

Abstract

Computer security systems protect computers and networks from unauthorized use by external agents and insiders. The similarities between computer security and the problem of protecting a body against damage from externally and internally generated threats are compelling and were recognized as early as 1972 when the term computer virus was coined. The connection to immunology was made explicit in the mid 1990s, leading to a variety of prototypes, commercial products, attacks, and analyses. The paper reviews one thread of this active research area, focusing on system-call monitoring and its application to anomaly intrusion detection and response.The paper discusses the biological principles illustrated by the method, followed by a brief review of how system call monitoring was used in anomaly intrusion detection and the results that were obtained. Proposed attacks against the method are discussed, along with several important branches of research that have arisen since the original papers were published. These include other data modeling methods, extensions to the original system call method, and rate limiting responses. Finally, the significance of this body of work and areas of possible future investigation are outlined in the conclusion.

Efficient and effective realtime prediction of drive-by download attacks

“…The Opcode function calls are captured as a sequence of integers and extracted with no additional processing, thereby reducing the log trace overhead. Evaluating only function keyword sequences has also be successfully deployed at the kernel level for anomaly detection in operating systems [12,13,34,53].…”

“…Figure 1 is a sample snippet of JavaScript code used to perform a drive-by download attack. The code contains a shellcode (line 2), a routine for constructing a NOP sled (lines 3-10), and a heap spraying attack (lines [12][13][14][15][16][17][18]. The shellcode is a binary payload injected and executed on a user device.…”

Towards Automated Malware Behavioral Analysis and Profiling for Digital Forensic Investigation Purposes

“…Dynamic malware analysis methods monitor the interactions between a malware sample and an operating system kernel [19,20], e.g. invoked system calls and its arguments.…”

Program Counter Encoding for ARM<sup>®</sup> Architecture

“…Even without a contemplation of the accuracy of the CFG, a couple of issues arise from this conceptual control flow validation scenario such as CFG granularity and the representation and storage of the CFG. System-call-level CFG was utilized during the early days of the technology to reduce the overhead of the CFG representation and storage, and also to enable access to the CFG at runtime [13]; however, such a coarse-grain CFG often fails to catch a compromised control flow because many hundreds or thousands of instructions can exist between the system calls.…”