Design of an Intrusion Detection Model under Linux Based on System-call Monitoring

王泽芳,陈小平,史烈

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.11.055

2002-01-01

Abstract:Intrustion detection system is very important in computer security.The article introduces the idea of intrusion detection based on system-call monitoring under Linux and the design of the corresponding model.

What problem does this paper attempt to address?

An Intrusion Detection System Based On System Call

Yue Shen,Fei Yu,Ling-Fen Zhang,Ji-Yao An,Miao-Liang Zhu

DOI: https://doi.org/10.1109/CANET.2005.1598184

2005-01-01

Abstract:Intrusion detection is an efficient way to protect information system. This paper puts forward a new method of anomalous intrusion detection based on system call. It uses system calls regarded as input, and creates a FSA for the functions in the program. Then the FSA is used to detect the attack. Moreover, It can find the place of the vulnerability which exists in the program. This can help to alter the source program. Results are shown that this method is effective for some intrusion events.
Multi-agent based hybrid Intrusion detection system

张宝军,潘雪增,王界兵,平玲娣

DOI: https://doi.org/10.3785/j.issn.1008-973X.2009.06.004

2009-01-01

Abstract:Real-time intrusion detection under current network environment exists the following problems: first, the scale of network is large, and a great deal of information needs to be processed, which requires large throughput to the intrusion detection system (IDS); second, the network environment is complex, and the data type is multiplex, accordantly, the intrusion detection system should has high accuracy. Aiming at these problems, a model of intrusion detection system was proposed. The model uses the distributed architecture based on multi-agent system and shows good expansibility, and can self-adjust according to the scale and bandwidth of network. The model uses technologies of anomaly intrusion detection and misuse intrusion detection together, and has low false alert rate and miss alert rate. Multi-attribute data abstraction is used in the model to grasp the feature of intrusion accurately and provide strong support for intrusion identification. The classifier is constructed with radial basis function (RBF) so as to have good extension to unknown intrusions, and can do effective judgment to unknown intrusions. Experimental results show that the system has large throughput and high accuracy, thus it is suitable for current network and has good practicability.
Research on Data Mining-based Intrusion Detection in Real-time Environment

胡敏,潘雪增,平玲娣

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.01.033

2004-01-01

Abstract:This paper focuses on issures related to deploying a data mining-based IDS (Intrusion Detection System) in a real time environment To overcome the limitations of traditional IDS, the corresponding solutions to accurracy, efficiency and usability is presented.These solutions impove efficiency of traditional DOS and maintain a desired accuracy level. This paper also proposed an architecture consisting of sensors, detectors, a data warehouse and model generation components. This architecture facilitates the sharing and storage of audit data and the distribution of new or updated models. Also, it improves the efficiency and scalability of the traditional IDS.
Intrusion Detection And Simulation For High-Speed Networks

Fei Yu,XiaoPing Dai,Yue Shen,Huang Huang,Miaoliang Zhu

DOI: https://doi.org/10.1109/ICSSSM.2005.1500110

2005-01-01

Abstract:The problem in network security presently is how to get real-time intrusion detection and alert. In the paper, we design Intrusion Detection System architecture and arithmetic again, meanwhile put forward an improved pattern matching arithmetic based on protocol analysis and theorization machine on Frete. New architecture can use network processor to collect and analyze data in network bottom, which enhance the speed and efficiency in Detection System.
Design and Implementation of Network Worm Detection System for Internal Network

WANG Wei,LU Dongming,DONG Yabo,CHEN Yufeng

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.17.072

2006-01-01

Abstract:With the rapid development of computer technology,Internet applications are used more and more widely,computer networks are exposed to various threats,especially network worms.This paper introduces the definition and principle of network worms,and based on the mechanism of network worms,it proposes and implements a network worm detection system for Internal network,which is proved to be able to detect the network worm accurately.
Research on Information Security Model and Security System Design

黄益民,平玲娣,潘雪增

DOI: https://doi.org/10.3785/j.issn.1008-973x.2001.06.005

2001-01-01

Abstract:After study of existing security models; analysis of information flow model, Bell-LaPadula(BLP) access control model and Biba access control model; and collation and comparison of their advantages and disadvantages, an improved model is put forward that satisfies the actual demands of information security. An implementation strategy is put forward that ensures information security, reliability, practicality and compatibility in the designed security system. An implementation scheme of this security system and its components and functions is provided. This system combines the following functions: mandatory access contro1, privilege separation, security audit, identity authentication and self-protection. It achieves the level 3 of national information security standard and level B1 of TCSEC standard. It was implemented in the Windows NT and Linux operating system and has yielded good resultsin application.
Design of Intrusion Detection System Based on Software Component

徐辉,潘爱民

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.06.002

2004-01-01

Abstract:This paper introduces the application of software component technology in intrusion detection system design. A component-based intrusion detection system model is proposed, which has high extensibility and reusability. This paper also proposes an application-oriented simple component model under Linux, named SCOM.
Research and Design of Intrusion Detection Systems Based on SNMP

Xiao He

2010-01-01

Abstract:This paper analyzes the current methods commonly used in intrusion detection and network intrusion attacks,based on an SNMP-based Intrusion Detection System protocol design.Through reading and analyzing Management Information Base(MIB) of the network connection information,aiming at the characteristics of network intrusion and attacks,The program monitoring the network.The system consists of six modules,to realize network intrusion detection.
Design and Implementation of Intrusion Detection System Based on Web

YU Shun-zhi,WANG Chun-lu,XUE Yi-bo,WANG Dong-sheng

DOI: https://doi.org/10.3969/j.issn.1000-7024.2006.21.033

2006-01-01

Abstract:Intrusion detection is an importantnetworksecurity approach.Itcan monitor network traffic online and make the rapid response to the invasion.An intrusion detection system based on web is designed and implemented.This system is running on web browser,so it can store alerts and logs to database and provide them to the user through graphic interface.By this method,the user can conveniently search,sort andmanage thelog data.Thus it hasthefollowingfeatures: simple operation,flexibleconfiguration,andfriendlyinterface,etc.
A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

蔡忠闽,彭勤科,管晓宏,孙国基

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.07.028

2002-01-01

Abstract:In this paper we present a multi-layer and defense-in-depth intrusion detection model for networked computer systems with a prototype. In this model, the operations on the protected computer system are monitored by four sensors from different viewpoints. The final judgement is made by combining the results of the individual sensors using information fusion techniques. It is demonstrated that an anomaly behavior can be more easily discovered and false alarms can be effectively reduced using our detection model. The methods to detect intrusions at different layers are also discussed using the experience gained in prototype realization.
Design and realization of a network security monitoring system based on C/S model

张伟胜,陈刚,董金祥

DOI: https://doi.org/10.3969/j.issn.1000-7024.2002.11.014

2002-01-01

Abstract:The paper not only introduces the importance of the network security in intranet, but also brings forward the model and the structure of network security monitoring system. Furthermore it presents the design and realization of the system.
Study of Intrusion Detecton Mondels for Web Applications

ZHOU Yong-lu,WU Hai-yan,JIANG Dong-xing

DOI: https://doi.org/10.3969/j.issn.1671-0428.2012.05.004

2012-01-01

Abstract:As traditional security techniques fail to protect web applications from attacks,more research has focus on intrusion detection for web applications.Access logs are the most important data source for intrusion detection.However,log files usually contain a huge quantity of records.Without effective methods,it is not feasible for administrator to inspect and locate intrusions.Misuse detection and anomaly detection models have been proposed to solve this problem.This paper conducts intrusion detection over a real web application based on statistical anomaly-based models.The result shows these models can effectively detect attacks like SQL injection.
Intrusion Detection Model Based on Intention Modeling

Jun LU,Chong-jun WANG,Jun WANG,Shi-fu CHEN

DOI: https://doi.org/10.3969/j.issn.1001-3695.2007.05.035

2007-01-01

Abstract:Through researching the past and resent network intrusion and intrusion detection system,intention modeling and intention recognition to intrusion detection system and propose an intrusion detection system model IRAIDS were introduced,which helps to solve distributed intelligent network intrusions.
Study on Abnormal Detection Based on System Call and Data Mining Technique

ZHAO Yu-ming,ZHANG Wei,teng SH

2007-01-01

Abstract:The technique of intrusion detection has become a focus in the field ofnetwork security. This paper introduced the categories of intrusion detection and the methods of data mining applied in abnormal detection. It also described the design and implementation of the abnormal IDS based on system call and data mining algorithms.
A Model for Intrusion Detection System Based on Mobile Agent

陆骏,王凯,吕志军,黄皓

DOI: https://doi.org/10.3321/j.issn:1002-8331.2003.28.051

2003-01-01

Abstract:This paper analyzes some shortcomings which are inherent in the current network-based IDS.Then it evaluates the benefits of applying mobile agent technology to the field of intrusion detection.Finally it proposes an intrusion detection system model,which is based on mobile agent technology.
Anomaly Detection Based on System Call Classification

徐明,陈纯,应晶

2004-01-01

Journal of Software

Abstract:The aim of this paper is to create a new anomaly detection model based on rules. A detailed classification of the LINUX system calls according to their function and level of threat is presented. The detection model only aims at critical calls (I.e. The threat level 1 calls). In the learning process, the etection model dynamically processes every critical call, but does not use data mining or statistics from static data. Therefore, the increment learning could be implemented. Based on some simple predefined rules and refining, the number of rules in the rule database could be reduced dramatically, so that the rule match time can be reduced effectively during detection processing. The experimental results clearly demonstrate that the detection model can effectively detect R2L, R2R and L2R attacks. Moreover the detected anomaly is limited in the corresponding requests, but not in the entire trace. The detection model is fit for the privileged processes, especially for those based on request-responses.
An Intrusion Detection System for Network Storage Based on System Calls

Li-zhong Geng,Hui-bo Jia

DOI: https://doi.org/10.1109/IAS.2009.100

2009-01-01

Abstract:Rapid increase of information resources speeds the development of network storage. And security of network storage satisfies the demands of privacy and safety of the information. Data encryption and personal identity authentication which are based on cryptography can protect the storage against non-authorized access, while they are ineffective for malicious authorized users and inherent attacks. Also heavy performances affect the control of storage. This paper demonstrates an efficient intrusion detection system model for network-attached storage based on system calls and improves the Process Homeostasis to realize the implementation. The experimental results demonstrate high detection rate and low false detection rate. The total performance is about 3% additions when the detection system is running normally.
Research and Design of Kernel Based Illegal Connection Mornitoring

Hao Huang

2010-01-01

Abstract:An anti-illegal connection system is designed based on analyzing the related anti-illegal connection technologies.The system uses authentication and strategy to ensure the credibility of the communcate object and uses SNMP-based network topology discovery algorithm to guarantee timely detection of intranet connected host which is not installed client, and then combines with the device control and kernel monitoring technology to ensure the implementation of the security.Finally, illegal connections are avoided.
Intrusion Detection System for Applications using Linux Containers

Amr Abed

DOI: https://doi.org/10.31224/osf.io/5uyac

2016-12-31

Abstract:Linux containers are gaining increasing traction in both individual and industrial use, and as these containers get integrated into mission-critical systems, real-time detection of malicious cyber attacks becomes a critical operational requirement. This paper introduces a real-time host-based intrusion detection system that can be used to passively detect malfeasance against applications within Linux containers running in a standalone or in a cloud multi-tenancy environment. The demonstrated intrusion detection system uses bags of system calls monitored from the host kernel for learning the behavior of an application running within a Linux container and determining anomalous container behavior. Performance of the approach using a database application was measured and results are discussed.
Research And Design Of Nids Based On Linux Firewall

Jia Zongpu,Liu Shufen,Wang Guowei

DOI: https://doi.org/10.1109/SPCA.2006.297482

2006-01-01

Abstract:Firewall has many shortages, such as it cannot keep away interior attacks, it cannot provide a consistent security strategy, and it has a single bottleneck spot and invalid spot, etc. Intrusion Detection System (IDS) also has many defects, such as low detection ability, lack of effective response mechanism, poor manageability, etc. If firewall and IDS are integrated, the cooperation of them can implement the network security to a great extent: on the one hand, IDS monitors the network, provides a real-time detection of attacks from the interior and exterior, and automatically informs firewall and dynamically alters the rules of firewall once an attack is found; on the other hand, firewall loads dynamic rules to hold up the intrusion, controls the data traffic of IDS and provides the security protection of IDS. Based on constructing firewall with Iptables in the environment of Linux OS, the respective characters of firewall and IDS are analyzed. Then, the viewpoint of integrating firewall and IDS to realize the network security is proposed, and the application and algorithm of intrusion detection are systemically analyzed and designed.

Design of an Intrusion Detection Model under Linux Based on System-call Monitoring

An Intrusion Detection System Based On System Call

Multi-agent based hybrid Intrusion detection system

Research on Data Mining-based Intrusion Detection in Real-time Environment

Intrusion Detection And Simulation For High-Speed Networks

Design and Implementation of Network Worm Detection System for Internal Network

Research on Information Security Model and Security System Design

Design of Intrusion Detection System Based on Software Component

Research and Design of Intrusion Detection Systems Based on SNMP

Design and Implementation of Intrusion Detection System Based on Web

A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

Design and realization of a network security monitoring system based on C/S model

Study of Intrusion Detecton Mondels for Web Applications

Intrusion Detection Model Based on Intention Modeling

Study on Abnormal Detection Based on System Call and Data Mining Technique

A Model for Intrusion Detection System Based on Mobile Agent

Anomaly Detection Based on System Call Classification

An Intrusion Detection System for Network Storage Based on System Calls

Research and Design of Kernel Based Illegal Connection Mornitoring

Intrusion Detection System for Applications using Linux Containers

Research And Design Of Nids Based On Linux Firewall