A Study of Intrusion Prevention System against Collaborative and Inherited Attacks

Abstract

Based on the system call interception technique, we develop a real-time intrusion prevention system to solve both the collaborative and inherited attacks. This system intercepts every system call invoked by application programs and tries to match any penetration patterns. Once there are evidences showing certain penetration is happening, the system can terminate the penetration process before it hurts the system. To improve detection accuracy, we build an inspection model analogous to the human-immunity concept that traces interactions among processes that constitute a villain family. With the help of these enhancements, our system can solve the collaborative attack problems, and can also select normal-behaved template genes to reduce false positive alarm rate.