US 8,028,336 B2Granted

Intrusion detection using dynamic tracing

AssigneeOracle America, Inc.

InventorsChristoph L. Schuba, Dwight Hare, Hal Stern

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques have been developed whereby dynamic kernel/user-level tracing may be employed to efficiently characterize runtime behavior of production code. Using dynamic tracing techniques, user space or kernel instruction sequences between system calls may be instrumented without access to source code. In some realizations, instrumentation may be interactively specified on a host system. In some realizations, instrumentation specifications may be supplied as functional definitions (e.g., as scripts and/or probe definitions) for installation on a host system. Using the developed techniques, data states, parameters passed and/or timing information may be sampled to provide more detailed insight into actual program behavior. In signature-oriented exploitations, more powerful intrusion signatures are possible. In anomaly-oriented exploitations, a more detailed “sense of self” may be developed to discriminate between normal and anomalous program behavior.

Claims10

Dependent claims

A computer readable encoding comprising software instructions, which when executed perform a method, the method comprising:

compiling a program comprising at least one disabled probe to obtain a compiled program;
executing the compiled program comprising the at least one disabled probe, wherein the at least one disabled probe does not collect information;
enabling the at least one disabled probe within the compiled program to obtain at least one enabled probe;
executing the compiled program comprising the enabled probe;
collecting, by the at least one enabled probe during the executing the compiled program comprising the enabled probe, information related to parameters passed across a user-code/kernel code boundary of a computer system executing the program;
generating a first trace characteristic using at least a portion of the information, wherein the first trace characteristic comprises information about a kernel code state of at least two system calls;
and
detecting an intrusion indication for the computer system, by comparing the first trace characteristic to a second trace characteristic,
wherein the computer readable encoding is embodied in at least one physical computer readable medium selected from a group consisting of a magnetic storage medium, an optical storage medium, a semiconductor storage medium, and an electronic storage medium.

6 more elements

Dependencies are inferred from the claim text.