A methodology to detect intrusion using system call based on discriminant analysis

Abstract

An intrusion detection system seeks to identify unauthorized access to computer systems' resources and data. Many methods have been proposed to detect intrusion; for example, the pattern matching method to finding intrusion by matching sample data to know intrusive patterns and the statistical approach to detect intrusion from normal activities at the user level or system level. We will investigate a new method for detecting intrusion at the level of privilege process. This method bases on the number of system call during a user's network activity on host machine. Evidence is given that short sequences of system call executed by running programs are good discriminator between normal activities and intrusive activities by using discriminant analysis, a kind of multivariate analysis. We are trying to detect intrusions by analyzing some of system calls occuring on a host machine by discriminant analysis with the Mahalanobis' distance. Our method will be lightweight intrusion detection method, given that it requires only certain of system call for analysis.