Compacting Security Signatures for PIGA IDS - Archive ouverte HAL Access content directly
Conference Papers Year : 2012

Compacting Security Signatures for PIGA IDS

Pascal Berthomé
  • Function : Author
  • PersonId : 853747
Jérémy Briffaut
Pierre Clairet
  • Function : Author
  • PersonId : 934892

Abstract

PIGA (Policy Interaction Graph Analysis) is a tool that detects malicious process behaviours by analysing the operating system activities. This tool uses signatures that represent illegal activities of some malicious user. These signatures are generated from a graph that models the performed operations at operating system (OS) level. For usual security properties, the number of signatures is large and they are stored in the memory during the detection process. In this paper, we present a way to reduce the memory required to store the signatures while preserving their quality. The methodology is derived from the modular decomposition of graphs. We investigate the impact of such an approach for the confidentiality property. The efficiency of the methodology is evaluated on interaction graphs of real operating systems. The number of signatures is divided by 20 for the tested confidentiality property
No file

Dates and versions

hal-00770935 , version 1 (07-01-2013)

Identifiers

  • HAL Id : hal-00770935 , version 1

Cite

Pascal Berthomé, Jérémy Briffaut, Pierre Clairet. Compacting Security Signatures for PIGA IDS. SECURWARE-2012, Aug 2012, Rome, Italy. pp.126--133. ⟨hal-00770935⟩
89 View
0 Download

Share

Gmail Mastodon Facebook X LinkedIn More