Publication Type
Conference Paper
Publication Date
Page Numbers
134 to 142
Conference Name
6th International Conference on Information Warfare and Security
Conference Location
Washington, Virginia, United States of America
Conference Date
Abstract
The host-based detection of malicious data exfiltration activities is currently a sparse area of research and mostly limited to methods that analyze network traffic or signature based detection methods that target specific processes. In this paper we explore an alternative method to host-based detection that exploits sequences of system calls and new collection methods that allow us to catch these activities in real time. We show that system calls sequences can be found to reach a steady state across processes and users, and explore the viability of new methods as heuristics for profiling user behaviors.
