Design of Intrusion Detection System at User Level with System-Call Interposing

As computers have become widely used, software vulnerability is now one of the most serious security threats. In particular, viruses and worms that use buffer overflow vulnerabilities are serious threats to computers. Therefore, techniques to detect the execution of malicious code are required when taking measures to prevent intrusion using such software vulnerabilities. An intrusion detection system is an example of such a defence mechanism against such attacks. The improvement in both false positive and false negative ratios, together with reduction of overhead are the problems to be overcome in an intrusion detection system. This paper presents the design of a user level intrusion detection system. This system can monitor the execution of target programs at both user and kernel levels. The access control function is divided between user and kernel. Access rights may also be checked with appropriate timing and with low overhead.