System Call Attack Detection Using Instrumented Delimiters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively link kernel-level system call analysis to user-level program attacks, missing vulnerabilities and failing to accurately identify the program sections causing the attacks due to the difference between user and kernel levels.
Innovation Solution
Instrumentation is added to a program to include delimiters in system call streams, linking attacks to specific program portions by augmenting the system call stream with application-level data, using a delimiter to separate uninteresting from targeted program sections, and employing an attack model to detect malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If system call requests are analyzed independently at the kernel level, then anomaly detection can be performed, but the analysis misses vulnerabilities and fails to link attacks to the corresponding program sections
Solution Approach 1:
The patent introduces delimiters as intermediary markers that are inserted into the system call stream at specific program locations. These delimiters act as mediators that connect kernel-level system call observations back to user-level program sections, enabling precise linkage between detected anomalies and their originating code without requiring direct access to program execution context at the kernel level
2Measurement precision
If instrumentation is added to link system calls to program portions, then attack linkage is improved, but system complexity increases
Solution Approach 1:
The patent segments the program into specific portions of interest and inserts delimiters only at the boundaries of these segments rather than instrumenting the entire program. This selective segmentation approach maintains precise program section identification while minimizing the complexity overhead by focusing instrumentation only on critical code regions
3Reliability
If static or dynamic analysis is performed on the program, then vulnerabilities can be detected, but the analysis is time-consuming and may miss runtime attacks
Solution Approach 1:
The patent performs preliminary action by inserting delimiters into the system call stream during program execution setup, before runtime attacks occur. This preliminary instrumentation enables real-time attack detection during execution without requiring time-consuming static analysis, while the delimiters are pre-positioned to enable rapid identification of attacked program sections
Data Source
AI summary
The operations include obtaining a system call stream from executing an instrumented program comprising an instrumented portion. The instrumented portion comprises instrumentation to add. The operations further include monitoring the system call stream for a start delimiter defined by instrumentation in the instrumented program, extracting a system call trace starting at the start delimiter, processing the system call trace through an attack model to obtain an attack probability, detecting an attack based on a comparison of the attack probability with an attack detection threshold, and generating an alert identifying the attack and the instrumented portion.