A probabilistic method for detecting anomalous program behavior

Kohei Tatara; Toshihiro Tabata; Kouichi Sakurai

doi:10.1007/978-3-540-31815-6_8

A probabilistic method for detecting anomalous program behavior

Kohei Tatara, Toshihiro Tabata, Kouichi Sakurai

Mathematical Informatics

Research output: Contribution to journal › Conference article › peer-review

Abstract

In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

Original language	English
Pages (from-to)	87-98
Number of pages	12
Journal	Lecture Notes in Computer Science
Volume	3325
DOIs	https://doi.org/10.1007/978-3-540-31815-6_8
Publication status	Published - 2005
Event	5th International Workshop on Information Security Applications, WISA 2004 - Jeju Island, Korea, Republic of Duration: Aug 23 2004 → Aug 25 2004

All Science Journal Classification (ASJC) codes

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-540-31815-6_8

Cite this

@article{0d1c44f78a374708be05b37b4448fc63,

title = "A probabilistic method for detecting anomalous program behavior",

abstract = "In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.",

author = "Kohei Tatara and Toshihiro Tabata and Kouichi Sakurai",

year = "2005",

doi = "10.1007/978-3-540-31815-6_8",

language = "English",

volume = "3325",

pages = "87--98",

journal = "Lecture Notes in Computer Science",

issn = "0302-9743",

publisher = "Springer Science and Business Media Deutschland GmbH",

note = "5th International Workshop on Information Security Applications, WISA 2004 ; Conference date: 23-08-2004 Through 25-08-2004",

}

TY - JOUR

T1 - A probabilistic method for detecting anomalous program behavior

AU - Tatara, Kohei

AU - Tabata, Toshihiro

AU - Sakurai, Kouichi

PY - 2005

Y1 - 2005

N2 - In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

AB - In this paper, we, as well as Eskin, Lee, Stolfo propose a method of prediction model. In their method, the program was characterized with both the order and the kind of system calls. We focus on a non-sequential feature of system calls given from a program. We apply a Bayesian network to predicting the N-th system call from the sequence of system calls of the length N - 1. In addition, we show that a correlation between several kinds of system calls can be expressed by using our method, and can characterize a program behavior.

UR - http://www.scopus.com/inward/record.url?scp=23944486376&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=23944486376&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-31815-6_8

DO - 10.1007/978-3-540-31815-6_8

M3 - Conference article

AN - SCOPUS:23944486376

SN - 0302-9743

VL - 3325

SP - 87

EP - 98

JO - Lecture Notes in Computer Science

JF - Lecture Notes in Computer Science

T2 - 5th International Workshop on Information Security Applications, WISA 2004

Y2 - 23 August 2004 through 25 August 2004

ER -

A probabilistic method for detecting anomalous program behavior

Abstract

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this