KERNAL-BASED INTRUSION DETECTION USING BLOOM FILTERS
Kernel-based intrusion detection using Bloom filters is disclosed. In one of many possible embodiments for detecting an intrusion attack, a Bloom filter is provided and used to generate a Bloom filter data object. The Bloom filter data object contains data representative of expected system-call behavior associated with a computer program. The Bloom filter data object is embedded in an operating system (“OS”) kernel upon an invocation of the computer program. Actual system-call behavior is compared with the data in the Bloom filter data object.
1 . A method comprising:
receiving a Bloom filter data object containing data representative of expected system-call behavior associated with a computer program;
embedding said Bloom filter data object in an operating system (“OS”) kernel upon an invocation of the computer program; and
comparing actual system-call behavior with said data in said Bloom filter data object.
2 - 28 . (canceled)
29 . The method of claim 1 , further comprising generating said Bloom filter data object using a Bloom filter, said Bloom filter including a set of hash functions.
30 . The method of claim 1 , further comprising:
monitoring system calls of the computer program, said monitoring step being performed in said OS kernel of the computer; and
using said monitored system calls to define said expected system-call behavior of the computer program.
31 . The method of claim 1 , further comprising appending said Bloom filter data object to an executable image of the computer program.
32 . The method of claim 1 , further comprising performing said comparing step in said OS kernel in real time.
33 . The method of claim 1 , wherein said data of said Bloom filter data object is representative of predetermined sequences of system calls.
34 . The method of claim 1 , further comprising issuing an alert in response to a determination that said actual system-call behavior deviates from said data of said Bloom filter data object.
35 . The method of claim 1 , wherein said expected system-call behavior is defined automatically, without user intervention.
36 . The method of claim 1 , further comprising:
identifying a sequence of system calls generated by the computer program, and
comparing said identified sequence of system calls with said data in said Bloom filter data object to determine if said identified sequence of system calls is a normal sequence of system calls for the computer program.
37 . A system, comprising:
a computer having a processor and a memory configured to:
receive a Bloom filter data object containing data representative of expected system-call behavior associated with a computer program;
embed said Bloom filter data object in an operating system (“OS”) kernel upon an invocation of the computer program; and
compare actual system-call behavior with said data in said Bloom filter data object.
38 . The system of claim 37 , wherein said Bloom filter data object is generated using a Bloom filter, said Bloom filter including a set of hash functions.
39 . The system of claim 37 , wherein the computer is further configured to:
monitor system calls of the computer program, said monitoring step being performed in said OS kernel of the computer; and
use said monitored system calls to define said expected system-call behavior of the computer program.
40 . The system of claim 37 , wherein the computer is further configured to append said Bloom filter data object to an executable image of the computer program.
41 . The system of claim 37 , wherein the computer is further configured to:
identify a sequence of system calls generated by the computer program, and
compare said identified sequence of system calls with said data in said Bloom filter data object to determine if said identified sequence of system calls is a normal sequence of system calls for the computer program.
42 . A non-transitory computer-readable medium comprising a set of computer-executable instructions tangibly embodied thereon, the instructions including instructions for:
receiving a Bloom filter data object containing data representative of expected system-call behavior associated with a computer program;
embedding said Bloom filter data object in an operating system (“OS”) kernel upon an invocation of the computer program; and
comparing actual system-call behavior with said data in said Bloom filter data object.
43 . The medium of claim 42 , wherein said Bloom filter data object is generated using a Bloom filter, said Bloom filter including a set of hash functions.
44 . The medium of claim 42 , further comprising instructions for:
identifying a sequence of system calls generated by the computer program, and
comparing said identified sequence of system calls with said data in said Bloom filter data object to determine if said identified sequence of system calls is a normal sequence of system calls for the computer program.
45 . The medium of claim 42 , further comprising instructions for:
monitoring system calls of the computer program, said monitoring step being performed in said OS kernel of the computer; and
using said monitored system calls to define said expected system-call behavior of the computer program.
46 . The medium of claim 42 , further comprising instructions for appending said Bloom filter data object to an executable image of the computer program.
47 . The medium of claim 42 , wherein said expected system-call behavior is defined automatically, without user intervention.