Paper Info
Title
SoIDPS: sensor objects-based intrusion detection and prevention system and its implementation
Abstract
In this paper, we propose an intrusion detection and prevention system using sensor objects that are a kind of trap and are accessible only by the programs that are allowed by the system. Any access to the sensor object by disallowed programs or any transmission of the sensor object to outside of the system is regarded as an intrusion. In such case, the proposed system logs the related information on the process as well as the network connections, and terminates the suspicious process to prevent any possible intrusion. By implementing the proposed method as Loadable Kernel Module (LKM) in the Linux, it is impossible for any process to access the sensor objects without permission. In addition, the security policy will be dynamically applied at run time. Experimental results show that the security policy is enforced with negligible overhead, compared to the performance of the unmodified original system.
Year
DOI
Venue
2005
10.1007/11596981_38
CIS (2)
Keywords
Field
DocType
suspicious process,loadable kernel module,sensor objects-based intrusion detection,prevention system,unmodified original system,security policy,proposed system log,possible intrusion,intrusion detection,sensor object
Information system,Permission,Object detection,Host-based intrusion detection system,Object-oriented programming,Computer science,Loadable kernel module,Security policy,Intrusion detection system,Embedded system
Conference
Volume
ISSN
ISBN
3802
0302-9743
3-540-30819-9
Citations 
PageRank 
References 
0
0.34
6
Authors
4
Name
Order
Citations
PageRank
Seong-Je Cho112427.85
Hye-Young Chang291.97
Hong-Geun Kim3113.70
Woongchul Choi4136.67