Please use this identifier to cite or link to this item: https://doi.org/10.1007/978-3-642-29860-8_10
Title: NORT: Runtime anomaly-based monitoring of malicious behavior for windows
Authors: Milea, N.A.
Khoo, S.C. 
Lo, D.
Pop, C.
Issue Date: 2012
Source: Milea, N.A.,Khoo, S.C.,Lo, D.,Pop, C. (2012). NORT: Runtime anomaly-based monitoring of malicious behavior for windows. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 7186 LNCS : 115-130. ScholarBank@NUS Repository. https://doi.org/10.1007/978-3-642-29860-8_10
Abstract: Protecting running programs from exploits has been the focus of many host-based intrusion detection systems. To this end various formal methods have been developed that either require manual construction of attack signatures or modelling of normal program behavior to detect exploits. In terms of the ability to discover new attacks before the infection spreads, the former approach has been found to be lacking in flexibility. Consequently, in this paper, we present an anomaly monitoring system, NORT, that verifies on-the-fly whether running programs comply to their expected normal behavior. The model of normal behavior is based on a rich set of discriminators such as minimal infrequent and maximal frequent iterative patterns of system calls, and relative entropy between distributions of system calls. Experiments run on malware samples have shown that our approach is able to effectively detect a broad range of attacks with very low overheads. © 2012 Springer-Verlag.
Source Title: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
URI: http://scholarbank.nus.edu.sg/handle/10635/41445
ISBN: 9783642298592
ISSN: 03029743
DOI: 10.1007/978-3-642-29860-8_10
Appears in Collections:Staff Publications

Show full item record
Files in This Item:
There are no files associated with this item.

SCOPUSTM   
Citations

4
checked on Dec 5, 2017

Page view(s)

57
checked on Dec 9, 2017

Google ScholarTM

Check

Altmetric


Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.