Robust Host Anomaly Detector Using Strong Isolation

Current operating systems become greater and complex increasingly and a great lot of vulnerabilities and hidden risks are in existence. Host-based intrusion detector is subject to attack relative to network-based intrusion detection because operating systems provide poor isolation. An alterative architecture and method used for host anomaly detector are proposed by making use of the SKAS mode of User Mode Linux Virtual Machine Monitor to enhance the survivability and robustness of anomaly detector on system calls. Even if attackers have gained unauthorized access to system services it is impossible for them to gain access chance to the anomaly detector because of strong space isolation. The primary experiments show that robustness, survivability and anomaly discriminating capability of host-based intrusion detector are improved.