Title:
Hardware Supported Anomaly Detection: down to the Control Flow Level
Hardware Supported Anomaly Detection: down to the Control Flow Level
| dc.contributor.author | Zhang, Tao | |
| dc.contributor.author | Zhuang, Xiaotong | |
| dc.contributor.author | Pande, Santosh | |
| dc.contributor.author | Lee, Wenke | |
| dc.date.accessioned | 2004-08-11T19:12:21Z | |
| dc.date.available | 2004-08-11T19:12:21Z | |
| dc.date.issued | 2004-03-10 | |
| dc.description.abstract | Modern computer systems are plagued with security flaws, making them vulnerable to various malicious attacks. Intrusion detection systems have been proposed to protect computer systems from unauthorized penetration. Detecting an attack early on pays off since further damage is avoided and resilient recovery could be adopted. An intrusion detection system monitors dynamic program behavior against normal program behavior and raises an alert when anomaly is detected. The normal behaviour is learnt by the system through training and profiling. However, all current intrusion detection systems are purely software based and thus suffer from huge performance degradation due to constant monitoring operations inserted in the application code. Due to the potential performance overhead, software based solutions cannot monitor the program behavior at a very fine level of granularity, thus leaving potential security holes as shown in [5]. In this paper, we propose a hardware-based approach to verify the control flow of target applications dynamically and to detect anomalous executions. With hardware support, our approach offers multiple advantages over software based solutions including near zero performance degradation, much stronger detection capability (a larger variety of attacks get detected) and zero-latency reaction upon anomaly and thus much better security. | en |
| dc.format.extent | 303736 bytes | |
| dc.format.mimetype | application/pdf | |
| dc.identifier.uri | http://hdl.handle.net/1853/96 | |
| dc.language.iso | en_US | |
| dc.publisher | Georgia Institute of Technology | |
| dc.relation.ispartofseries | CERCS;GIT-CERCS-04-11 | |
| dc.subject | Behavior monitoring | |
| dc.subject | Hardware based solutions | |
| dc.subject | Intrusion Detection Systems (IDS) | |
| dc.subject | Malicious attacks | |
| dc.subject | Profiling | |
| dc.subject | Security | |
| dc.subject | Zero performance degradation | |
| dc.title | Hardware Supported Anomaly Detection: down to the Control Flow Level | en |
| dc.type | Text | |
| dc.type.genre | Technical Report | |
| dspace.entity.type | Publication | |
| local.contributor.author | Pande, Santosh | |
| local.contributor.author | Lee, Wenke | |
| local.contributor.corporatename | Center for Experimental Research in Computer Systems | |
| local.relation.ispartofseries | CERCS Technical Report Series | |
| relation.isAuthorOfPublication | 6239fe5b-32c4-4067-9614-1ccca3374873 | |
| relation.isAuthorOfPublication | c2f2a105-702f-45e4-a8a3-4ca5eb3d0eec | |
| relation.isOrgUnitOfPublication | 1dd858c0-be27-47fd-873d-208407cf0794 | |
| relation.isSeriesOfPublication | bc21f6b3-4b86-4b92-8b66-d65d59e12c54 |