US 7,181,768 B1Granted

Computer intrusion detection system and method based on application monitoring

AssigneeCigital

InventorsAnup K. Ghosh, Michael Schatz, Christoph C. Michael, Aaron Schwartzbard

Life of this patent

Estimating the term…

Loading patent…

Abstract

An intrusion detection system (IDS) that uses application monitors for detecting application-based attacks against computer systems. The IDS implements application monitors in the form of a software program to learn and monitor the behavior of system programs in order to detect attacks against computer hosts. The application monitors implement machine learning algorithms to provide a mechanism for learning from previously observed behavior in order to recognize future attacks that it has not seen before. The application monitors include temporal locality algorithms to increased the accuracy of the IDS. The IDS of the present invention may comprise a string-matching program, a neural network, or a time series prediction algorithm for learning normal application behavior and for detecting anomalies.

Claims24

Dependent claims

A detection system for detecting intrusive behavior in a session on a computer during an application monitoring phase, said session comprising a plurality of applications invoked on said computer, and said computer having a computer operating system, said detection system comprising:

(a) a plurality of trained neural networks, wherein each trained neural network has previously been trained during a training phase to identify a pre-determined behavior pattern for a corresponding one of the plurality of applications, and wherein each trained neural network is selected for use in the application monitoring phase based upon performance during a testing phase and based upon a machine learning algorithm, wherein the machine learning algorithm employs a string distance metric, other than string matching, for preprocessing its inputs during learning, wherein a string is defined as a sequence of symbols and the string distance metric is based on at least one of events common to two strings and the difference in positions of common events, and the string distance metric is used to measure the distance from an input string to each of several exemplar strings;
(b) a plurality of application profiles, wherein each application profile comprises a plurality of application data for a corresponding one of the plurality of applications, wherein said application data is collected during the session;
(c) a temporal locality identifier, wherein when one of the plurality of application profiles is sequentially input to a corresponding one of the plurality of trained neural networks the trained neural network outputs a behavior indicator for each of the plurality of data strings in the application profile;
and wherein if the behavior indicator meets a pre-determined criteria, a counter is incremented, and wherein if the counter has a high rate of increase the temporal locality identifier labels the application behavior intrusive, and wherein if a predetermined percentage of application behaviors are intrusive the session behavior is labeled intrusive.

1 more element

A method for detecting intrusive behavior in a session on a computer during an application monitoring phase, said session comprising a plurality of applications invoked on said computer, and said computer having a computer operating system, said method comprising the steps of:

(a) training a plurality of neural networks during a training phase, wherein each neural network is trained to identify a pre-determined behavior pattern for a corresponding one of the plurality of applications;
(b) selecting for use one or more trained neural networks based upon performance during a testing phase and based upon a machine learning algorithm, wherein the machine learning algorithm employs a string distance metric, other than string matching, for preprocessing its inputs during learning, wherein a string is defined as a sequence of symbols and the string distance metric is based on at least one of events common to two strings and the difference in positions of common events, and the string distance metric is used to measure the distance from an input string to each of several exemplar strings;
(c) creating a plurality of application profiles, wherein each application profile comprises a plurality of application data for a corresponding one of the plurality of applications, wherein said application data is collected during the session;
(d) performing a temporal locality identifying algorithm, wherein when one of the plurality of application profiles is sequentially input to a corresponding one of the plurality of trained neural networks the trained neural network outputs a behavior indicator for each of the plurality of data strings in the application profile, and wherein if the behavior indicator meets a pre-determined criteria, a counter is incremented, and wherein if the counter has a high rate of increase the temporal locality identifier labels the application behavior intrusive, and wherein if a predetermined percentage of application behaviors are intrusive the session behavior is labeled intrusive.

1 more element

Dependencies are inferred from the claim text.

Facts

Application: 09/698,159Filed 30 Oct 2000 · us provisional application
Priority: 28 Oct 1999
Granted: 20 Feb 2007
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06N 3/06
Neural networks: physical realisation, i.e. hardware implementation of neural networks, neurons or parts of neurons
H04L
Digital communication