We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior. Thus, unlike most statistical detection methods that focus on syntactic features, our approach is semantic in nature. Therefore, it is more robust against obfuscation techniques used by malware that change the outward appearance of the trace but not its effect. We demonstrate the efficacy of our approach by evaluating it on actual system call traces.
@cite_0 is considered the seminal work which pushed forward research on methods and representations of operating system process monitoring based on system calls. @cite_13 provides an early comparison of machine learning methods for modeling process behavior. @cite_2 introduces the model of execution graph, and behavior similarity-measure based on the execution graph. @cite_22 combines multiple models into an ensemble to improve anomaly detection. @cite_26 applies continuous time Bayesian network (CTBN) to system call processes to account for time-dependent features and address high variability of system call streams over time. @cite_4 applies a deep LSTM-based architecture to sequences of individual system calls, treating system calls as a language model.
@cite_26 @cite_4 @cite_22 @cite_0 @cite_2 @cite_13
2137569638 1997491508 2890092828 1973026036
Many host-based anomaly detection systems monitor a process by observing the system calls it makes, and comparing these calls to a model of behavior for the program that the process should be executing. In this paper we introduce a new model of system call behavior, called an execution graph. The execution graph is the first such model that both requires no static analysis of the program source or binary, and conforms to the control flow graph of the program. When used as the model in an anomaly detection system monitoring system calls, it offers two strong properties: (i) it accepts only system call sequences that are consistent with the control flow graph of the program; (ii) it is maximal given a set of training data, meaning that any extensions to the execution graph could permit some intrusions to go undetected. In this paper, we formalize and prove these claims. We additionally evaluate the performance of our anomaly detection technique. Complex activities typically consist of multiple primitive events happening in parallel or sequentially over a period of time. Understanding such activities requires recognizing not only each individual event but, more importantly, capturing their spatiotemporal dependencies over different time intervals. Most of the current graphical model-based approaches have several limitations. First, time--sliced graphical models such as hidden Markov models (HMMs) and dynamic Bayesian networks are typically based on points of time and they hence can only capture three temporal relations: precedes, follows, and equals. Second, HMMs are probabilistic finite-state machines that grow exponentially as the number of parallel events increases. Third, other approaches such as syntactic and description-based methods, while rich in modeling temporal relationships, do not have the expressive power to capture uncertainties. To address these issues, we introduce the interval temporal Bayesian network (ITBN), a novel graphical model that combines the Bayesian Network with the interval algebra to explicitly model the temporal dependencies over time intervals. Advanced machine learning methods are introduced to learn the ITBN model structure and parameters. Experimental results show that by reasoning with spatiotemporal dependencies, the proposed model leads to a significantly improved performance when modeling and recognizing complex activities involving both parallel and sequential events. Sequential models which analyze system API calls have shown promise for detecting unknown malware. Athiwaratkun and Stokes recently proposed a two-stage model which uses a long short-term memory (LSTM) model for learning a set of features which are then input to a second classifier. , first use a convolutional neural network followed by an LSTM to predict unknown malware. However, neither of these models consider the parameters which are input to the system API calls. These input parameters offer significant information regarding malicious intent. In this paper, we extend Athiwaratkun's model to include each system API call's two most input parameters. We then show that the proposed model dominates these previously proposed models in terms of the receiver operating characteristic (ROC) curve. This paper presents the application of a Bayesian nonparametric time-series model to process monitoring and fault classification for industrial robotic tasks. By means of an alignment task performed with a real robot, we show how the proposed approach allows to learn a set of sensor signature models encoding the spatial and temporal correlations among wrench measurements recorded during a number of successful task executions. Using these models, it is possible to detect continuously and on-line deviations from the expected sensor readings. Separate models are learned for a set of possible error scenarios involving a human modifying the workspace configuration. These non-nominal task executions are correctly detected and classified with an on-line algorithm, which opens the possibility for the development of error-specific recovery strategies. Our work is complementary to previous approaches in robotics, where process monitors based on probabilistic models, but limited to contact events, were developed for control purposes. Instead, in this paper we focus on capturing dynamic models of sensor signatures throughout the whole task, therefore allowing continuous monitoring and extending the system ability to interpret and react to errors.