Monitoring Library Function-based Intrusion Prevention System with Continuing Execution Mechanism

Abstract

Anomaly-based Intrusion Prevention Systems have been studied to prevent zero-day attacks. However these existing systems can $B!G (Bt prevent mimicry attacks because of the inadequacy of monitoring accuracy. Moreover, they provide no continuity for monitored applications when they have been compromised. In this paper, we propose a novel Intrusion Prevention System named Belem that detects anomaly states by checking the ordering of library functions and has a Continuing Execution Mechanism to provide application continuity. We implemented Belem on Linux and evaluated it.