Data not found

Automatically Adapting a Trained Anomaly Detector to Software Patches

Country : Singapore
Department : Singapore Management University
Project Title : Automatically Adapting a Trained Anomaly Detector to Software Patches
Researcher : Reiter, Michael K. , GAO, Debin , LI, Peng
Keyword : Information Security
Publisher : Institutional Knowledge at Singapore Management University
Year End : 2009
Identifier : https://ink.library.smu.edu.sg/sis_research/475 , http://dx.doi.org/10.1007/978-3-642-04342-0_8
Source : Research Collection School Of Computing and Information Systems
Abstract / Description :

In order to detect a compromise of a running process based on it deviating from its program’s normal system-call behavior, an anomaly detector must first be trained with traces of system calls made by the program when provided clean inputs. When a patch for the monitored program is released, however, the system call behavior of the new version might differ from that of the version it replaces, rendering the anomaly detector too inaccurate for monitoring the new version. In this paper we explore an alternative to collecting traces of the new program version in a clean environment (which may take effort to set up), namely adapting the anomaly detector to accommodate the differences between the old and new program versions. We demonstrate that this adaptation is feasible for such an anomaly detector, given the output of a state-of-the-art binary difference analyzer. Our analysis includes both proofs of properties of the adapted detector, and empirical evaluation of adapted detectors based on four software case studies.

References

Reiter, Michael K.,GAO, Debin and LI, Peng. (2009). Automatically Adapting a Trained Anomaly Detector to Software Patches.  Singapore: Singapore Management University.
Reiter, Michael K.,GAO, Debin and LI, Peng. 2009. "Automatically Adapting a Trained Anomaly Detector to Software Patches".  Singapore: Singapore Management University.
Reiter, Michael K.,GAO, Debin and LI, Peng. "Automatically Adapting a Trained Anomaly Detector to Software Patches."  Singapore: Singapore Management University, 2009. Print.
Reiter, Michael K.,GAO, Debin and LI, Peng. Automatically Adapting a Trained Anomaly Detector to Software Patches. Singapore: Singapore Management University; 2009.

Export

Share