Study on Software Vulnerability Discovering Based on Linux Sequence of System Call

Abstract:

Considering the efficiency problem of software vulnerability discovering in Linux system, a new software vulnerability discovering in Linux system program with data mining algorithm is proposed in this paper. An improved REL algorithm based on one-dimensional linked list is proposed, and mining on Linux sequence data of system call with REL algorithm, then we do analysis and detection of software vulnerabilities. A model of software vulnerability discovering analysis system with LRE algorithm was designed. Finally, experimental results show the validity of mining on Linux sequence data of system call with REL algorithm in terms of reducing the false alarm rate, and improving the efficiency of software security vulnerability discovering.

• Periodical: Applied Mechanics and Materials (Volume 151)
• Pages: 537-543
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.151.537
• Online since: January 2012
• Authors: Chong Wang, Guang Jun Song, Chun Lan Zhao
• Keywords: Data Mining (DM), Linux System, System Call Sequence, Vulnerability Discovering

References

[1] Forrest S., Hofmeyr S.A., Somayaji A., Longstaff T.A. A sense of self for UNIX processes, Proceedings of the 1996 IEEE Symposium on Security and Privacy, 1996, 120-128.

DOI: 10.1109/secpri.1996.502675

[2] Lee W，Stolfo S J. Data mining approaches for intrusion detection[C]. Proc of the 7th USENIX Security Symp. San Antonio：USENIX，1998：6-9.

[3] Lane T. Hidden Markov models for human/computer interface modeling[C]. Proc of the International AI Society. Proc of the IJCAI- 99 Workshop on Learning about Users. Stockholm：International AI Society，1999：35- 44.

[4] Sekar R，Bendre M，Dhurjati D，et al. A fast automaton–based method for detecting anomalous program behaviors[C]/IEEE Computer Society. Oakland：IEEE，2000：144-155.

DOI: 10.1109/secpri.2001.924295

[5] Ghosh AK, Schwartzbard A, A study in using neural networks for anomaly and misuse detection, Proceedings of USENIX security symposium, 1999, 51-62.

[6] Zhang C L, Jiang J, Mohamed K. Intrusion detection using hierar-chical neural networks[J]. Pattern Recognition Letters，2005，26(6): 779- 791.

[7] Han S J, Cho S B. Evolutionary neural networks for anomaly detection based on the behavior of a program[J]. IEEE Transactions on Systems, Man, and Cybernetics-Part B: Cybernetics 2006, 36(3): 559- 570.

DOI: 10.1109/tsmcb.2005.860136

[8] R. Agrawal, and R. Srikant. Fast algorithms for mining association rules. In Proc. 1994 Int. Conf. Very Large Databases(VLDB'94), Sep. (1994).

[9] J. Han,J. Pei, and Y. Yin. Mining. Frequent patterns without candidate generation. In Proc. 2000 ACM-SIGMOD Int. Conf. Management of Data (SIGMOD'00), p. pp.1-12, May (2000).

DOI: 10.1145/335191.335372

[10] M. Zaki, S. Parthasarathy, M. Ogihara, and W. Li. New Algorithms for Fast Discovery of Association Rules. Proc. 3rd Int. Conf. on Knowledge Discovery and Data Mining (KDD'97, Newport Beach, CA), 283–296. AAAI Press, Menlo Park, CA, USA (1997).

DOI: 10.1007/978-1-4615-5669-5_1

[11] Christian Borgelt. Keeping Things Simple: Finding Frequent Item Sets by Recursive Elimination Workshop Open Source Data Mining Software (OSDM'05, Chicago, IL), 66-70. ACM Press, New York, NY, USA (2005).

DOI: 10.1145/1133905.1133914

[12] http: /www. almaden. ibm. com/cs/projects/iis/hdb/Projects/data_mining/datasets/syndata. html.

[13] http/www. cs. unm. edu/~immsec/systemcalls. htm.