Compacting Security Signatures for PIGA IDS - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

Compacting Security Signatures for PIGA IDS

Pascal Berthomé
  • Fonction : Auteur
  • PersonId : 853747
Jérémy Briffaut
Pierre Clairet
  • Fonction : Auteur
  • PersonId : 934892

Résumé

PIGA (Policy Interaction Graph Analysis) is a tool that detects malicious process behaviours by analysing the operating system activities. This tool uses signatures that represent illegal activities of some malicious user. These signatures are generated from a graph that models the performed operations at operating system (OS) level. For usual security properties, the number of signatures is large and they are stored in the memory during the detection process. In this paper, we present a way to reduce the memory required to store the signatures while preserving their quality. The methodology is derived from the modular decomposition of graphs. We investigate the impact of such an approach for the confidentiality property. The efficiency of the methodology is evaluated on interaction graphs of real operating systems. The number of signatures is divided by 20 for the tested confidentiality property
Fichier non déposé

Dates et versions

hal-00770935 , version 1 (07-01-2013)

Identifiants

  • HAL Id : hal-00770935 , version 1

Citer

Pascal Berthomé, Jérémy Briffaut, Pierre Clairet. Compacting Security Signatures for PIGA IDS. SECURWARE-2012, Aug 2012, Rome, Italy. pp.126--133. ⟨hal-00770935⟩
89 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More