RE: HIDS - new technologies ?

From: Brennen Reynolds (
Date: 07/11/02

Date: Wed, 10 Jul 2002 21:16:23 -0700
From: Brennen Reynolds <>


        While it is not a commercial IDS by any means, systrace
( by Niels Provos does what you
are describing. A profile is created of acceptable system calls and if an
anomaly is detected an appropriate action is taken. I believe he has
implemented in on several BSD platforms and is currently porting it to

Brennen Reynolds
Graduate Researcher
Security & Network Lab
University of California, Davis

-----Original Message-----
From: Kunal Rupera []
Sent: Wednesday, July 10, 2002 1:13 PM
Subject: HIDS - new technologies ?

Hello everyone ..!
        Currently host based intrusion detection systems usually consists of
programs like Sentinel or Tripwire which do file integrity checks using
various checksumming algorithms. Now there are some new upcoming
technologies like HIDS based on system calls. <---- to quote a very crude example..
something on these lines but not exactly the way imsafe functions. Now would
it be possible to make a HIDS that is based on system calls? . to site a
example, most windows based anti viral programs hook the I/O calls and do
not let a infected.exe get executed. so would it be possible to write a
program which monitors for executable files and when one is executed, checks
if it contains "bad" signatures and allows or prevents that executable file
from getting executed? . {this applies to *nix platforms} so that exploits
(mostly local root buffer overflows) can be prevented from running? ..
ofcourse such HIDS systems would have the limitations that most NIDS systems
have eg. encrypted payload to site one of them... etc.. but wont it be
effective for most cases?
Views/Flames/Ideas/Help/Links/Discussions. all welcome... :)..

Unix System Administrator
Sun Certified Solaris Administrator