Host based intrusion detection system

Abstract Intrusion detection is the powerful tool to protect the networks and system from attacks. Intrusion detection has two types host based and network based intrusion detection system. Network based intrusion system to detect the unwanted and abnormal behaviour activates in the network. Host based intrusion detection is monitoring and detecting attacks in the system side. In this paper we use host base intrusion detection method to detect the misbehaviour and unknown attacks based upon the system calls. Here we using sendmail processor system call dataset for detect the abnormal behaviour of system calls. Normal and intrusive behaviour collected and gather the system calls sequences for sendmail process. Data mining play the important role to detect the intrusion. Here we using classification rule mining techniques for detect the intrusion in system calls. From the data set using RIPPER rule extract the normal behaviour characterises of the system call. Using normal behaviour construct the profile and compare the sequence of system call for to detect the anomaly sequence system calls. Our proposed system is give good performance and reduces the time complexity and flash alarm rates.

Keywords IDS; System call; Anomaly detection.

I. Introduction

Apart from anti viruses, firewalls and additional security devices to give the complete security, Intrusion Detection Systems are also essential. Some of the software defencelessness such as buffer over flow in UNIX, bugs in Microsoft internet explorer and operating system still are inconveniencing the users of the present software. When an intruder penetrates the firewall or the preventing security facilities, IDS can come in handy. Hence, Intrusion Detection Systems (IDS) can continuously improve the security in our operating system and other software.

Intrusion Detection System (IDS) constitute a fundamental element in Communication Company's infrastructure. Along with the firewalls, the IDS represent the main security tools of the network: firewalls for the external threats and IDS as much for the external ones as for the internal ones to the organization. Although during a period of time the firewalls only reduces the exhibition of the system, reason why is important to have a monitoring and detecting system.

Intrusion detection systems main security functions are monitor, detect, and respond to abnormal activity by company internal and external intrusion. Intrusion detection systems use some rules to define the normal and alarm will be raised if that event is intruder . Certain intrusion detection systems have the ability of sending out alerts, so that the administrator of the IDS will get a warning of a possible security happening in the form of a page, email, or SNMP trap. Many intrusion detection systems not only recognize a exacting incident and issue an proper alert, they also react automatically to the event. Such a reaction might take in logging off a user, disabling a user account, and launching of scripts

Intrusion Detection is the insistent active challenges in understanding or detecting the occurrence of intrusive activities. It refers to all processes used in discovering illegal uses of network or computer devices. This is accomplished through exclusively designed software with a sole principle of detecting unusual or abnormal activity. Such software is called Intrusion Detection System.

A. Types of intrusion detection system

There are two type of Intrusion detection systems that employ one or both of the intrusion methods outlined above. Host-based systems base their results on information attained from a single host (generally audit trails), even as network-based intrusion detection systems gain the data by supervising the traffic in the network to which the hosts are connected

1) Host-based intrusion detection

A generic intrusion detection model proposed by Denning (1987) is a rule based pattern matching system in which the intrusion detection tasks are conducted by checking the similarity between the current audit record and the corresponding profiles. If the current audit record deviates from the normal patterns, it will be considered an anomaly. Several IDSs were developed using profile and rule based approaches to identify intrusion activity.

2) Network-based intrusion detection

With the proliferation of the computer networks, more and more individual hosts are connected into local area networks, and/or wide area networks. However, the hosts, as well as the networks are exposed to the intrusion due to the vulnerabilities of network devices and network protocols. The TCP/ IP protocol can be also exploited by the network intrusions such as IP spoofing, port scanning, and so on. Therefore, network-based intrusion detection has become important and is designed to protect a computer network as well as of its hosts. The installation of a network-based intrusion detection system can also decrease the burden of the intrusion detection task on every individual host.

B. Intrusion Detection techniques

The signatures of some attacks are known, where as other attacks only reflect some deviation from normal patterns. Consequently, two main approaches have been devised to detect intruders

1) Anomaly Detection

Anomaly detection assumes that an intrusion will always reflect some deviations from normal patterns. Anomaly detection may be divided into static and dynamic detection. A static anomaly detector is based on the assumption that there is a portion of the system being monitored that does not change. Usually, static detectors only address the software portion of a system and are based on the assumption that the hardware need not be checked. The static portion of a system is the code for the system and the constant portion of data upon which the correct functioning of the system depends. For example, operating systems software and data to bootstrap a computer never change. If the static portion of the system ever deviates from its original form, an error has occurred or an intruder has altered the static portion of the system. Therefore static anomaly detectors focus on integrity checking. Dynamic detection typically operates on audit records or on monitored networked traffic data. Audit records of operating systems do not record all events that is recorded in the audit will be observed and these events may occur in a sequence. In distributed systems, partial ordering of events is sufficient for detection. In other cases, the order is not directly represented: only cumulative information, such as cumulative processor resources used during a time interval, is maintained. In this case, thresholds are defined to separate normal resources consumption from anomalous resources consumption.

2) Misuse Detection

Misuse detection is based on the knowledge of system vulnerabilities and known attack patterns. Misuse detection is concerned with finding intruders who are attempting to break into a system by exploiting some known vulnerability. Ideally, a system security administrator should be aware of all the known vulnerabilities and eliminate them. The term intrusion scenario is used as a description of a known kind of intrusion: it is a sequence of events that would result in an intrusion without some outside preventive intervention. An intrusion detection system continually compares recent activity to known intrusion scenarios to ensure that one or more attackers are not attempting to exploit known vulnerabilities. To perform this, each intrusion scenarios must be described or modelled. The main difference between the misuse techniques is in how they describe or model the behaviour that constitutes an intrusion. The original misuse detection systems used rules to describe events indicative o intrusion actions that a security administrator looked for within the system. Large numbers of rules can be difficult to interpret. If-then rules are not grouped by intrusion scenarios and therefore making modifications to the rule set can be difficulty as the affected rules are spread out across the rule set. To improve these difficulties, new rule organization and state transition diagrams. Misuse detection systems use the rules to look for events that possibly fit an intrusion scenario. The events may be monitored live by monitoring system calls or later using audit records.

3) Advantages and Disadvantages of anomaly detection and misuse detection

The main disadvantage of misuse detection approaches is that they will detect only the attacks for which they are trained to detect. Novel attacks or unknown attacks or even variants of common attacks often go undetected. At a time when new security vulnerabilities in software are discovered and exploited every day,, the reactive approach embodied by misuse detection methods is not feasible for defeating malicious attacks. The main advantage of anomaly detection approaches is the ability to detect novel attacks or unknown attacks against software systems, variants of known attacks, and deviations of normal usage of programs regardless of whether the source is a privileged internal user or an unauthorized external user. The disadvantage of the anomaly detection approach is that well-known attacks may not be detected, particularly if they fit the established profile of the user. Once detected, it is then difficult to characterize the nature of the attack for the forensic purposes. Another drawback of many anomaly detection approaches is that a malicious user who knows that he or she is being profiled can change the profile slowly over time to essentially train the anomaly detection system to learn the attacker's malicious behavior as normal. Finally a high false positive rate may result for a narrowly trained detection algorithm, or conversely, a high false negative rate may result for a broadly trained anomaly detection approach

II. related work

The Computer Immunology Project at the University of New Mexico (Warrender et al., 1999; Forrest et al., 1997, 1996) explored designs of IDS based on immunology. Small, individual agents would roam on a distributed system, identify intrusions, and resolve the intrusions. One portion of the project developed a sense of self for security related computer programs by observing the normal sets of system calls executed by the programs. This sense of self can be used to detect intrusions by discovering when a program executes an unusual set of system calls. The Computer Immunology Project differs from our system in their focus on individual agents rather than an integrated system of cooperating Multi-agents.

1996, Forrest et al [1] is proposed a model for detecting intrusion at sequence of system calls given by privilege process. She traced sendmail process of UNIX for collecting sequence of system calls in normal mode. She also collected instructive behavior of instructive process in unsafe mode. Forrest introduces a method for construct the normal behavior by collecting shot sequence of system calls in a running process. Shot sequence may be 5, 7, 9 and 11. Once normal behavior database constructed then scan the new traces for abnormal behaviors and also looking for sequence system calls that are not presented in the normal data base. After normal and abnormal behavior collected it can be analyzed to detect the intrusion.

Later work by Warrender et al [3] extended this technique in sequence time-delay embedding (stide), which memorized all contiguous sequences of predetermined, fixed lengths during training. An anomaly count was defined as the number of mismatches in a temporally local region. A threshold was set for the anomaly score above which a sequence is flagged anomalous, indicating a possible attack. A.Hafmer , Martin and Lee continued the Forrest work

Y.Li [4] and C.V.Raman are proposed a model by using Hidden markov model (HMM). They are traces the shot sequence of system call collected and analysis the normal and abnormal behavior by Hidden markov model. From the past research work on the system call area normal behavior is gathering from the normal data set and they will be able to detect the new sequence of system calls of the new process that may be normal or abnormal.


System can be monitored at various levels. Various things including ability, cost, and accuracy to make distinguish from normal and abnormal behaviour .Typically, intrusion detection systems monitor either user behaviour or privileged processes ( Dan Zhu et al., 2001).

The privileged process is observed through 'system calls' that the Unix process uses to access system resources. Hofmeyr et al. (1998) found that short sequences of system calls are a good discriminator for several types of intrusion.

The data used in this study is based on an immune system developed at the University of New Mexico. It is for one privileged program-send mail. The data includes both normal and abnormal traces. The normal trace is a trace of the send mail daemon and several invocations of the send mail programs. During the period of collecting these traces, there are no intrusions or any suspicious activities happening. The abnormal traces contain several traces including intrusions that exploit well-known problems in Unix systems. For example, Sunsendmailcp (SSCP) is scripts that sendmail uses to append an email message to a file, but when used on a file such as /.rhosts, a local user may obtain root access. Syslog attack uses the syslog interface to overflow a buffer in send mail. Forwarding loops occur in send mail when a set of files in $home/.forward form a logical circle. In our study, intrusion traces include five error conditions of forwarding loops, three sunsendmailcp (sscp) attacks, two traces of the syslog-remote attacks, two traces of syslog-local attacks, and two traces of decode attacks, and two traces of unsuccessful intrusion attempts-sm565a. Detailed descriptions of these intrusions can be found in Hofmeyr et al. (1998). Each trace has two attributes: the first one is the process ID, indicating the process the system call belongs to; and the second one is the system call value.

Please be aware that the free essay that you were just reading was not written by us. This essay, and all of the others available to view on the website, were provided to us by students in exchange for services that we offer. This relationship helps our students to get an even better deal while also contributing to the biggest free essay resource in the UK!