The Evolution of System-Call Monitoring

Computer security systems protect computers and networks from unauthorized use by external agents and insiders. The similarities between computer security and the problem of protecting a body against damage from externally and internally generated threats are compelling and were recognized as early as 1972 when the term computer virus was coined. The connection to immunology was made explicit in the mid 1990s, leading to a variety of prototypes, commercial products, attacks, and analyses. The paper reviews one thread of this active research area, focusing on system-call monitoring and its application to anomaly intrusion detection and response. The paper discusses the biological principles illustrated by the method, followed by a brief review of how system call monitoring was used in anomaly intrusion detection and the results that were obtained. Proposed attacks against the method are discussed, along with several important branches of research that have arisen since the original pap...

• Type: Conference
• Year: 2008
• Where: ACSAC
• Authors: Stephanie Forrest, Steven A. Hofmeyr, Anil Somayaji
• Keywords: ACSAC 2008, Computer Security, Computer Security Systems, Intrusion Detection, Security Privacy