Intrusion detection using dynamic tracing
Techniques have been developed whereby dynamic kernel/user-level tracing may be employed to efficiently characterize runtime behavior of production code. Using dynamic tracing techniques, user space or kernel instruction sequences between system calls may be instrumented without access to source code. In some realizations, instrumentation may be interactively specified on a host system. In some realizations, instrumentation specifications may be supplied as functional definitions (e.g., as scripts and/or probe definitions) for installation on a host system. Using the developed techniques, data states, parameters passed and/or timing information may be sampled to provide more detailed insight into actual program behavior. In signature-oriented exploitations, more powerful intrusion signatures are possible. In anomaly-oriented exploitations, a more detailed “sense of self” may be developed to discriminate between normal and anomalous program behavior.
1. A computer readable encoding comprising software instructions, which when executed perform a method, the method comprising:
compiling a program comprising at least one disabled probe to obtain a compiled program;
executing the compiled program comprising the at least one disabled probe, wherein the at least one disabled probe does not collect information;
enabling the at least one disabled probe within the compiled program to obtain at least one enabled probe;
executing the compiled program comprising the enabled probe;
collecting, by the at least one enabled probe during the executing the compiled program comprising the enabled probe, information related to parameters passed across a user-code/kernel code boundary of a computer system executing the program;
generating a first trace characteristic using at least a portion of the information, wherein the first trace characteristic comprises information about a kernel code state of at least two system calls; and
detecting an intrusion indication for the computer system, by comparing the first trace characteristic to a second trace characteristic,
wherein the computer readable encoding is embodied in at least one physical computer readable medium selected from a group consisting of a magnetic storage medium, an optical storage medium, a semiconductor storage medium, and an electronic storage medium.
2. The computer readable encoding of claim 1 , combined with a dynamic tracing facility to at least partially define an intrusion detection system.
3. The computer readable encoding of claim 1 ,
wherein the at least one enabled probe is further configured to sample at least one selected from a group comprising user identity (UID), data state, and timing information.
4. The computer readable encoding of claim 1 ,
wherein the at least one enabled probe is further configured to characterize user-level activity of a software system.
5. The computer readable encoding of claim 1 ,
wherein the second trace characteristic corresponds to a baseline characteristic generated for the computer system under conditions believed to be substantially free of intrusion; and
wherein the intrusion indication is provided if the first trace characteristic is suggestive of anomalous behavior when compared to the baseline characteristic.
6. The computer readable encoding of claim 1 ,
wherein the program is executed on the computer system one or more times under controlled conditions to generate the second trace characteristic.
7. The computer readable encoding of claim 1 ,
wherein the second trace characteristic corresponds to an intrusion signature; and
wherein the intrusion indication is provided if the first trace characteristic is substantially correlated with the intrusion signature.
8. The computer readable encoding of claim 1 ,
wherein enabling the at least one disabled probe is at least partially responsive to an escalation of security posture.
9. The computer readable encoding of claim 1 ,
wherein the program consists entirely of kernel code.
10. The computer security method of claim 1 , embodied in a host-based intrusion detection system deployed in a computer network.