US 7,024,694 B1 · Method and apparatus for content-based instrusion detection using an agile kernel-based auditor

Abstract

One embodiment of the present invention provides content-based intrusion detection for a computer system by using an agile kernel-based auditing system. This auditing system operates by receiving an audit specification that specifies target attributes to be recorded during an auditing process. The audit specification also specifies an auditing criterion that triggers recording of the target attributes. Upon receiving the audit specification, the auditing system is configured to record the target attributes during system calls whenever the auditing criterion is satisfied. Next, an application program is monitored by the auditing system to produce an audit log containing the recorded target attributes. This audit log is examined in order to detect patterns for intrusion detection purposes. In one embodiment of the present invention, configuring the auditing system involves compiling the audit specification to produce a kernel module, and then loading the kernel module into a kernel of an operating system. It also involves linking code from within the kernel module into system calls within the operating system. In one embodiment of the present invention, in response to detecting an event during the auditing process, the system dynamically adjusts the auditing system to change the auditing criterion and/or the target attributes for subsequent operation of the auditing system.

Claims27

Dependent claims

A method for providing content-based intrusion detection for a computer system by using an agile kernel-based auditing system, comprising:

receiving an audit specification;
wherein the audit specification specifies at least one target attribute to be recorded from a set of possible target attributes during an auditing process by the auditing system;
wherein the audit specification also specifies at least one auditing criterion that triggers recording of the at least one target attribute during the auditing process;
configuring the auditing system to record the at least one target attribute in response to detecting the at least one auditing criterion;
running the auditing system to produce an audit log by recording the at least one target attribute in response to detecting the at least one auditing criterion;
and
examining the audit log to detect patterns for intrusion detection purposes;
wherein a size of the audit log is reduced when the auditing system is run prior to the examination for detection of the patterns.

5 more elements

A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for providing content-based intrusion detection for a computer system by using an agile kernel-based auditing system, the method comprising:

receiving an audit specification;
wherein the audit specification specifies at least one target attribute to be recorded from a set of possible target attributes during an auditing process by the auditing system;
wherein the audit specification also specifies at least one auditing criterion that triggers recording of the at least one target attribute during the auditing process;
configuring the auditing system to record the at least one target attribute in response to detecting the at least one auditing criterion in response to detecting the at least one auditing criterion;
running the auditing system to produce an audit log by recording the at least one target attribute;
and
examining the audit log to detect patterns for intrusion detection purposes;
wherein a size of the audit log is reduced when the auditing system is run prior to the examination for detection of the patterns.

5 more elements

A apparatus for providing content-based intrusion detection for a computer system by using an agile kernel-based auditing mechanism, comprising:

an auditing mechanism that is configured to audit system calls;
a receiving mechanism that is configured to receive an audit specification;
wherein the audit specification specifies at least one target attribute to be recorded from a set of possible target attributes during an auditing process by the auditing mechanism;
wherein the audit specification also specifies at least one auditing criterion that triggers recording of the at least one target attribute during the auditing process;
an initialization mechanism that configures the auditing mechanism to record the at least one target attribute in response to detecting the at least one auditing criterion;
wherein the auditing mechanism is configured to produce an audit log by recording the at least one target attribute in response to detecting the at least one auditing criterion;
and
an intrusion detection mechanism that is configured to examine the audit log to detect patterns for intrusion detection purposes;
wherein a size of the audit log is reduced when the auditing mechanism is run prior to the examination for detection of the patterns.

6 more elements

Dependencies are inferred from the claim text.

Method and apparatus for content-based instrusion detection using an agile kernel-based auditor

Life of this patent

Method and apparatus for content-based instrusion detection using an agile kernel-based auditor

Life of this patent

Abstract

Claims27