2026-09-18T23:46:26Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/49411 2023-07-11 col_2142_5131 col_2142_10761 com_2142_5130 com_2142_10755 com_2142_234

Campbell, Roy H. Chu, Jonathan 2014-05-30T16:42:36Z 2014-05-30T16:42:36Z 2014-05 2014-05-30T16:42:36Z 2014-05 In cyber security, engineers need to devise ways to protect their systems from hackers. One of the ways that they do this is through intrusion detection. Host based intrusion detection systems reside on the computer and perform internal diagnostics of a computer to detect malware and misuse. These HIDS use a variety of methods to detect and prevent attacks such as file integrity verification, log monitoring, file access patterns and etc. In this thesis, we look at the method of analyzing system calls for anomalous behavior. Programs use system calls to gain access to functions from an operating systems kernel. Therefore, it is theoretically possible to detect when a hacker may be exploiting a program by analyzing system call patterns of an application. However, despite previous work in this area, there remain many challenges to accurately detecting malicious exploits and intruders through system call analysis which have prevented it from being used in real systems. To help bridge the gap and address the challenges in making system call analysis a reality, we introduce a new method of system call analysis that we call the Triple Pot method. Our method utilizes three computers running concurrently on the same network to check for anomalous behavior of an application. The key idea is that by setting up a staged, fake network of computers we can get the hacker to identify their exploit for us. We will show how our method can be used to automatically identify zero day attacks that could not previously have been detected using previous system call analysis methods. In addition, we also introduce a method to aggregate and analyze system calls from distributed machines to use information from multiple computers to detect zero day attacks. We do this by creating a probabilistic model of the networked computer systems to determine the likelihood that an application is exhibiting anomalous behavior that is caused by a malicious hacker. Our methods can accurately locate malicious behavior with low false positives. Item withdrawn by Mark Zulauf (zulauf@illinois.edu) on 2014-04-29T20:14:07Z Item was in collections: University of Illinois Theses & Dissertations (ID: 1) No. of bitstreams: 2 mythesis.docx: 1130909 bytes, checksum: 1fa8aa3939267ca78d7d9c914285590b (MD5) Chu_Jonathan.pdf: 507057 bytes, checksum: ddc7699a6c734eb5b7dc37a883c97b5c (MD5) Made available in DSpace on 2014-05-30T16:42:36Z (GMT). No. of bitstreams: 4 Jonathan_Chu.pdf: 502670 bytes, checksum: 47ded871402416360dd046f5e0010168 (MD5) mythesis.docx: 1129666 bytes, checksum: a88bf35bd4ad1c1be2fa76756098b04f (MD5) 1_mythesis.docx: 1129666 bytes, checksum: a88bf35bd4ad1c1be2fa76756098b04f (MD5) license.txt: 4060 bytes, checksum: 71f36c4ba1a7a03400d4ead625948ba1 (MD5) http://hdl.handle.net/2142/49411 en Copyright 2014 Jonathan Ming-Guy Chu system call intrusion detection security computers The Triple Pot and techniques in distributed system call intrusion detection text Computer Science 1434 Computer Science 0112 University of Illinois at Urbana-Champaign Thesis M.S. MS:Computer Science -UIUC 10KS0112MS