Accurately Detecting Source Code of Attacks That Increase Privilege

Abstract

Host-based Intrusion Detection Systems (IDS) that rely on audit data exhibit a delay between attack execution and attack detection. A knowledgeable attacker can use this delay to disable the IDS, often by executing an attack that increases privilege. To prevent this we have begun to develop a system to detect these attacks before they are executed. The system separates incoming data into several categories, each of which is summarized using feature statistics that are combined to estimate the posterior probability that the data contains attack code. Our work to date has focused on detecting attacks embedded in shell code and C source code. We have evaluated this system by constructing large databases of normal and attack software written by many people, selecting features and training classifiers, then testing the system on a disjoint corpus of normal and attack code. Results show that such attack code can be detected accurately.

This work was sponsored by the Department of the Air Force under Air Force contract F19628-00-C-0002. Opinions, interpretations, conclusions, and recommendations are those of the authors and are not necessarily endorsed by the United States Air Force.