Evaluation of control flow traces in software applications for intrusion detection

Abstract

Software security has become an important requirement, particularly for systems that are publicly accessible through the Internet. Such systems can be equipped with intrusion detection systems to uncover security breaches. In this paper, we present a novel application-level intrusion detection approach. A normal behavior profile is created from application-internal control flow in terms of operation execution traces. Anomalous control flows indicative for intrusion attempts are detected by continuously monitoring and analyzing the software system. A case study demonstrates the intrusion detection approach's applicability in the context of a multi-user Java Web application.