An Alternative Approach To Computer System Security Monitoring And Enhancement Through System Call Sequence Analysis

Modern computer systems are plagued with stability and security problems: applications lose data, web servers are hacked, and systems crash under heavy load. Many of these problems or anomalies arise from rare program behavior caused by attacks or errors. A substantial percentage of the web-based attacks are due to buffer overflows. Many methods have been devised to detect and prevent anomalous situations that arise from buffer overflows. The current state-of-art of anomaly detection systems is relatively primitive and mainly depend on static code checking to take care of buffer overflow attacks. For protection, Stack Guards and I-leap Guards are also used in wide varieties.This dissertation proposes an anomaly detection system, based on frequencies of system calls in the system call trace. System call traces represented as frequency sequences are profiled using sequence sets. A sequence set is identified by the starting sequence and frequencies of specific system calls. The deviations of the current input sequence from the corresponding normal profile in the frequency pattern of system calls is computed and expressed as an anomaly score. A simple Bayesian model is used for an accurate detection.Experimental results are reported which show that frequency of system calls represented using sequence sets, captures the normal behavior of programs under normal conditions of usage. This captured behavior allows the system to detect anomalies with a low rate of false positives. Data are presented which show that Bayesian Network on frequency variations responds effectively to induced buffer overflows. It can also help administrators to detect deviations in program flow introduced due to errors.

Molecular characterization and phylogenetic analysis of a penaeidin-like antimicrobial peptide, Fi-penaeidin from Fenneropenaeus indicus

Antimicrobial peptides (AMPs) play a major role in innate immunity. Penaeidins are a family of AMPs that appear to be expressed in all penaeid shrimps. Penaeidins are composed of an N-terminal proline-rich domain, followed by a C-terminal domain containing six cysteine residues organized in two doublets. This study reports the first penaeidin AMP sequence, Fi-penaeidin (GenBank accession number HM243617) from the Indian white shrimp, Fenneropenaeus indicus. The full length cDNA consists of 186 base pairs encoding 61 amino acidswith an ORF of 42 amino acids and contains a putative signal peptide of 19 amino acids. Comparison of F. indicus penaeidin (Fi-penaeidin) with other known penaeidins showed that it shared maximum similarity with penaeidins of Farfantepenaeus paulensis and Farfantepenaeus subtilis (96% each). Fi-penaeidin has a predicted molecular weight (MW) of 4.478 kDa and theoretical isoelectric point (pI) of 5.3