Design and implementation of an extrusion-based break-in detector for personal computers
Weidong Cui
Katz, R.H.
Wai-tian Tan
California Univ., Berkeley, CA;
This paper appears in: Computer Security Applications Conference, 21st Annual
Publication Date: 5-9 Dec. 2005
On page(s): 10 pp.-370
Location: Tucson, AZ,
ISSN: 1063-9527
ISBN: 0-7695-2461-3
INSPEC Accession Number: 8970242
Digital Object Identifier: 10.1109/CSAC.2005.19
Current Version Published: 2006-01-03
Abstract
An increasing variety of malware, such as worms, spyware and adware, threatens both personal and business computing. Remotely controlled bot networks of compromised systems are growing quickly. In this paper, we tackle the problem of automated detection of break-ins caused by unknown malware targeting personal computers. We develop a host based system, BINDER (Break-IN DEtectoR), to detect break-ins by capturing user unintended malicious outbound connections (referred to as extrusions). To infer user intent, BINDER correlates outbound connections with user-driven input at the process level under the assumption that user intent is implied by user-driven input. Thus BINDER can detect a large class of unknown malware such as worms, spyware and adware without requiring signatures. We have successfully used BINDER to detect real world spyware on daily used computers and email worms on a controlled testbed with very small false positives
Index
Terms
Available to subscribers and IEEE members.
References
Available to subscribers and IEEE members.
Citing Documents
Available to subscribers and IEEE members.
Cart
