PROBE: A process behavior-based host intrusion prevention system

Minjin Kwon, Kyoochang Jeong, Heejo Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

3 Citations (Scopus)

Abstract

Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5% false-positive and 5% false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Pages203-217
Number of pages15
Volume4991 LNCS
DOIs
Publication statusPublished - 2008 Apr 7
Event4th Information Security Practice and Experience Conference, ISPEC 2008 - Sydney, NSW, Australia
Duration: 2008 Apr 212008 Apr 23

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume4991 LNCS
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other4th Information Security Practice and Experience Conference, ISPEC 2008
CountryAustralia
CitySydney, NSW
Period08/4/2108/4/23

Fingerprint

Intrusion detection
Processing
Vulnerability
Monitor
Weights and Measures
Attack
Intrusion Detection
False Positive
Equipment and Supplies
Heuristics
Unknown
Evaluation

ASJC Scopus subject areas

  • Biochemistry, Genetics and Molecular Biology(all)
  • Computer Science(all)
  • Theoretical Computer Science

Cite this

Kwon, M., Jeong, K., & Lee, H. (2008). PROBE: A process behavior-based host intrusion prevention system. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 4991 LNCS, pp. 203-217). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 4991 LNCS). https://doi.org/10.1007/978-3-540-79104-1_15

PROBE : A process behavior-based host intrusion prevention system. / Kwon, Minjin; Jeong, Kyoochang; Lee, Heejo.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 4991 LNCS 2008. p. 203-217 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 4991 LNCS).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Kwon, M, Jeong, K & Lee, H 2008, PROBE: A process behavior-based host intrusion prevention system. in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). vol. 4991 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 4991 LNCS, pp. 203-217, 4th Information Security Practice and Experience Conference, ISPEC 2008, Sydney, NSW, Australia, 08/4/21. https://doi.org/10.1007/978-3-540-79104-1_15
Kwon M, Jeong K, Lee H. PROBE: A process behavior-based host intrusion prevention system. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 4991 LNCS. 2008. p. 203-217. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-540-79104-1_15
Kwon, Minjin ; Jeong, Kyoochang ; Lee, Heejo. / PROBE : A process behavior-based host intrusion prevention system. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 4991 LNCS 2008. pp. 203-217 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{6e0b7c22c2b64ecf9226395483cae50c,
title = "PROBE: A process behavior-based host intrusion prevention system",
abstract = "Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5{\%} false-positive and 5{\%} false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.",
author = "Minjin Kwon and Kyoochang Jeong and Heejo Lee",
year = "2008",
month = "4",
day = "7",
doi = "10.1007/978-3-540-79104-1_15",
language = "English",
isbn = "3540791035",
volume = "4991 LNCS",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
pages = "203--217",
booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

}

TY - GEN

T1 - PROBE

T2 - A process behavior-based host intrusion prevention system

AU - Kwon, Minjin

AU - Jeong, Kyoochang

AU - Lee, Heejo

PY - 2008/4/7

Y1 - 2008/4/7

N2 - Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5% false-positive and 5% false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.

AB - Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5% false-positive and 5% false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.

UR - http://www.scopus.com/inward/record.url?scp=41549111606&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=41549111606&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-79104-1_15

DO - 10.1007/978-3-540-79104-1_15

M3 - Conference contribution

AN - SCOPUS:41549111606

SN - 3540791035

SN - 9783540791034

VL - 4991 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 203

EP - 217

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

ER -