A Useful Intrusion Detection System Prototype to Monitor Multi-processes Based on System Calls

摘要

Based on studying of process behaviors classification, a practical intrusion detection system prototype is discussed. As one of the key elements, the system behaviors classifier (Naive Bayesian Classifier) can identify malicious system behaviors effectively by classifying the sequences of system calls as normal or abnormal. However, an extended intrusion detection mechanism by monitoring multiple processes to detect intrusions that can modify the behaviors of system programs (such as: Trojan Horses, Buffer overflow attacks, and viruses.) is proposed.