Earticle

초록

영어

In this paper, a lightweight anomaly detection infrastructure named Anomaly Detection by Resource Monitoring is presented for Information Appliances. We call it Ayaka for short. It provides a monitoring function for detecting anomalies, especially attacks which are a symptom of resource abuse, by using the resource patterns of each process. Ayaka takes a completely application black-box approach, based on machine learning methods. It uses the clustering method to quantize the resource usage vector data and then learn the normal patterns with a hidden Markov Model. In the running phase, Ayaka finds anomalies by comparing the application resource usage with the learned model. This reduces the general overhead of the analyzer and makes it possible to monitor the process in real-time. The evaluation experiment indicates that our prototype system is able to detect anomalies such as SQL injection and buffer overrun with a minimum of false positives and small (about 1%) system overhead, without previously defined anomaly models.

목차

Abstract
 1. Introduction
 2. Related Work
 3. Model Construction Infrastructure
  3.1. Design Objectives
  3.2. Choosing Applicable Methods
  3.3. Model Learning with HMM
 4. Implementation
  4.1. Overall architecture
  4.2. Collecting the Resource Data
  4.3. User APIs
  4.4. Enforcement Policies
 5. Experiments & Evaluation
  5.1. Basic System Overhead
  5.2. Response Time Overhead
  5.3. Precision of Detection
 6. Discussion
 7. Conclusion
 References

키워드

저자

• Midori Sugaya [ Dependable Embedded OS R&D Center, Japan Science and Technology Agency, Tokyo, Japan ]
• Yuki Ohno [ School of Science and Engineering, Waseda University, Tokyo, Japan ]
• Tatsuo Nakajima [ School of Science and Engineering, Waseda University, Tokyo, Japan ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605