A gray-box DPDA-based intrusion detection technique using system-call monitoring

Jafar Haadi Jafarian, Ali Abbasi, Siavash Safaei Sheikhabadi

    Research output: Contribution to conferencePaperpeer-review

    2 Citations (Scopus)
    4 Downloads (Pure)


    In this paper, we present a novel technique for automatic and efficient intrusion detection based on learning program behaviors. Program behavior is captured in terms of issued system calls augmented with point-of-system-call information, and is modeled according to an efficient deterministic pushdown automaton (DPDA). The frequency of visit of each state is captured and statistically analyzed to detect abnormal execution patterns. This approach provides a very accurate learning of program behavior, which avoids a broad class of impossible path exploits. It also allows detection of new classes of attacks such as denial-of-service and brute-force dictionary attacks. We also present a complexity analysis of our model, and show that its time and space complexity is polynomial and fairly comparable to other similar approaches in learning, and hugely better in detection. Moreover, We evaluate our approach experimentally in terms of false positive rate, convergence rate, and performance. Finally, We shall discuss classes of attacks which are detectable and undetectable by our approach.
    Original languageUndefined
    Number of pages12
    Publication statusPublished - 1 Sept 2011
    Event8th Annual Collaboration, Electronic messaging, Anti-Abuse and Spam Conference - Perth, Australia
    Duration: 1 Sept 20112 Sept 2011


    Conference8th Annual Collaboration, Electronic messaging, Anti-Abuse and Spam Conference
    Other01-02 Sep 2011


    • System Call
    • Intrusion Detection
    • Host Based
    • DIES-Cyber Security
    • IR-92247
    • EWI-25171

    Cite this