A New Intrusion Detection Mechanism in SELinux

A new intrusion detection mechanism in SELinux based on dual-Markov chain and triggered by critical system calls is put forward in this paper. The mechanism integrates access control with intrusion detection by Linux Security Module (LSM) in SELinux and considers both the global behaviour characteristics and local behaviour characteristics. Theoretical analysis and experimental results show that the mechanism we propose is able to integrate access control with intrusion detection effectively and gets a preferable efficiency of intrusion detection, thus enhancing embedded system security.