Centre Mont-Royal
Montreal, Canada
July 13-17, 2009
Montreal, Canada
July 13-17, 2009
|
|
Centre Mont-Royal
Montreal, Canada July 13-17, 2009 |
|||||
|
Keynotes
Venue
|
Anomaly-based intrusion detection on Linux with pHMario Van Velzen (mario.vanvelzen@gmail.com)Anomaly-based intrusion detection systems can use rules or models from learned behaviour to determine if misuse is occurring. Rules can be difficult to write and maintain. Models learned from actual usage allow the system to better determine normal and abnormal behaviour. For computer programs, information about systems calls has been shown to be useful in modeling the operation of programs for security purposes. We present pH, a Linux implementation of such a system, which builds models from system calls, uses these models to identify abnormal behaviour, and delays or aborts abnormal system calls. We will focus on implementation, performance, and mitigation of false positives. |
| |||||||||||||||
|
Copyright © 2009 Linux Symposium Inc. All rights reserved. |
|||||||||||||||||
