Intrusion detection and virology: an analysis of differences, similarities and complementariness
Journal in Computer VirologyPublished 6 February 2007
Benjamin Morin, Ludovic Mé
Citations18
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This analysis of the differences, similarities and complementariness which exist between two major domains of nowadays information security: intrusion detection on one hand, virology and anti-viruses technologies on the other hand suggests that alert correlation is one way to make the two fields cooperate.
Abstract
In this paper, we analyze the differences, similarities and complementariness which exist between two major domains of nowadays information security: intrusion detection on one hand, virology and anti-viruses technologies on the other hand. This analysis is built from two points of view. First, we compare, through the definitions that have been proposed by researchers of the two communities, the goals that are actually pursued in each domain. Then, we compare the techniques that have been developed to reach these goals. In the conclusion, we summarize our analysis and suggest that alert correlation is one way to make the two fields cooperate.
Keywords
Computer Science
IEEE Transactions on Software EngineeringAn Intrusion-Detection Model
3,358 Citations1987Dorothy E. Denning
Lecture notes in computer scienceAnomalous Payload-Based Network Intrusion Detection
845 Citations2004Ke Wang, Salvatore J. Stolfo
A payload-based anomaly detector, called PAYL, for intrusion detection that demonstrates the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset the authors collected on the Columbia CS department network.
A sense of self for Unix processes
838 Citations2002Stephanie Forrest, Steven Hofmeyr +2 more
A method for anomaly detection is introduced in which "normal" is defined by short-range correlations in a process' system calls, and initial experiments suggest that the definition is stable during normal behaviour for standard UNIX programs.
Computers & SecurityComputer viruses
731 Citations1987Fred Cohen
This paper introduces ''computer viruses'' and examines their potential for causing widespread damage to computer systems and the infeasibility of viral defense in large classes of systems.
Annals of TelecommunicationsA revised taxonomy for intrusion-detection systems
346 Citations2000Hervé Debar, Marc Daciér +1 more
This paper extends the taxonomy beyond real- time intrusion detection to include additional aspects of security monitoring, such as vulnerability assessment, and introduces a taxonomy of intrusion- detection systems that highlights the various aspects of this area.
An immunological approach to change detection: algorithms, analysis and implications
326 Citations1996Patrik D’haeseleer, Stephanie Forrest +1 more
Lecture notes in computer scienceAnagram: A Content Anomaly Detector Resistant to Mimicry Attack
310 Citations2006Ke Wang, Janak J. Parekh +1 more
Anagram is presented, a content anomaly detector that models a mixture of high-order n-grams (n > 1) designed to detect anomalous and “suspicious” network packet payloads and is demonstrated that Anagram can identify anomalous traffic with high accuracy and low false positive rates.
An immunological approach to change detection: algorithms, analysis and implications
163 Citations2002Patrik D’haeseleer, Stephanie Forrest +1 more
Two detector-generating algorithms are introduced which run in linear time and heuristics are given for setting parameters based on the analysis, and the presence of holes in detector space is examined.
Lecture notes in computer scienceAn Abstract Theory of Computer Viruses
117 Citations1990Leonard M. Adleman
In recent years the detection of computer viruses has become common place, but whether or not computer viruses have the potential to cause major and prolonged disruptions of computing environments is an open question.
Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic
115 Citations2005Oleg Kolesnikov, Wenke Lee
The goal of this paper is to advance the science of IDS by analyzing techniques polymorphic worms can use to hide themselves and to stimulate further research to improve existing IDS.
Computer viruses: from theory to applications
109 Citations2005Éric Filiol
Part I - Genesis and Theory of Computer Viruses Introduction and The Formalization Foundations and The Antiviral Fight.
Lecture notes in computer scienceASAX: Software architecture and rule-based language for universal audit trail analysis
87 Citations1992Naji Habra, Baudouin Le Charlier +2 more
The project ASAX is outlined which aims at providing an advanced tool to support audit trail analysis and the language RUSSEL is a rulebased language which is tailor-made for the analysis of sequential files in one and only one pass.
Artificial LifeComputer Viruses as Artificial Life
75 Citations1994Eugene H. Spafford
This paper examines how viruses meet properties associated with life as defined by some researchers in the area of artificial life and self-organizing systems, and begins with a description of how computer viruses operate and their history.
Time series modeling for IDS alert management
73 Citations2006Jouni Viinikka, Hervé Debar +2 more
This paper presents the findings regarding the causes of background noise of intrusion detection systems, and one approach for monitoring the noise with reasonable user load is proposed, based on modeling regularities in alert flows with classical time series methods.
Noninterference and intrusion detection
41 Citations2005Calvin Ko, Tony Redmond
The noninterference model is applied in a novel way that allows us to formally represent valid interleaving between privileged and unprivileged processes and derive an algorithm for checking the assertions at run-time based on the developed theory and a formal model of Unix system calls.
Journal in Computer VirologyOn Abstract Computer Virology from a Recursion Theoretic Perspective
37 Citations2006G. Bonfante, Matthieu Kaczmarek +1 more
A new definition of viruses is suggested which is clearly based on the iteration theorem and above all on Kleene's recursion theorem and the results on virus detection are shown.
A Language Driven Intrusion Detection System for Event and Alert Correlation
33 Citations2004Éric Totel, Bernard Vivinis +1 more
Lecture notes in computer scienceFrom Declarative Signatures to Misuse IDS
28 Citations2001Jean-Philippe Pouzol, Mireille Ducasé
This article shows how to transform such declarative signatures into operational ones, and points out several technical details which must be considered with care when performing the translation by hand, but which can be systematically handled.
Formal specication of intrusion signatures and detection rules
22 Citations2005Jean-Philippe Pouzol, Mireille Ducassé
The approach is proposed to refine the declarative approach to intrusion detection, where the what and the how are still cleanly separated, but the security officer can possibly parameterize the detection by choosing a class for each signature.
Experimenting with a policy-based HIDS based on an information flow control model
21 Citations2004Jacob Zimmermann, Ludovic Mé +1 more
The results show that the model fulfills its goals and serves as a successful runtime policy-based intrusion detector on a standard OS.
Lecture notes in computer scienceToward an Abstract Computer Virology
15 Citations2005G. Bonfante, Matthieu Kaczmarek +1 more
A new definition of viruses is suggested which is clearly based on the iteration theorem and above all on Kleene’s recursion theorem and is shown that virus detection is Π2-complete.
From AntiVirus to AntiMalware Software and Beyond: Another Approach to the Protection of Customers from Dysfunctional System Behaviour
9 Citations1999Klaus Brunnstein
A definition is developed which distinguishes "normal" dysfunctionalties (produced through weaknesses of contemporary Software Engineering) from "intentionally malevolent" ones, both concerning classification of newly experienced threats and concerning online detection in user systems.
Lecture notes in computer scienceIntroducing Reference Flow Control for Detecting Intrusion Symptoms at the OS Level
8 Citations2002Jacob Zimmermann, Ludovic Mé +1 more
A novel approach to policy-based detection of attacks by delegation that enforces restrictions on whether an operation can be executed as a consequence of another, in order to detect that kind of attacks.