Detection Engine Based on Host System Calls for Distributed Intrusion Detection System

摘要

A detection and analysis engine based on sequences of host system calls is proposed, which can easily be carried by mobile agents in the distributed multi-agent intrusion detection systems. It has the advantages of the small size, high efficiency, simple mechanism, easy maintenance, dynamically upgrade, fast transportation and easy comprehension. The core spirit of the technique is that sequence of system calls executed by the privileged program is represented as the process vector of the short subsequences.