Searching System Call Information for Clues - The Effects of Intrusions on Processes (Paperback)

The United States Air Force extensively uses information systems as a tool for managing and maintaining its information. The increased dependence on these systems in recent years has necessitated the need for protection from threats of information warfare and cyber terrorism. One type of protection utilizes intrusion detection systems to provide indications that intrusive behavior has occurred. Other types of protection may include packet filtering, cryptography and strong user authentication. Traditional approaches toward intrusion detection rely on features that are external to computer processes. By treating processes as black-boxes, intrusion detection systems may miss a wealth of information that could be useful for detecting intrusions. This thesis effort investigates the effectiveness of anomaly-based intrusion detection using system call information from a computational process. Previous work uses sequences of system calls to identify anomalies in processes.