PROBE: A process behavior-based host intrusion prevention system

Minjin Kwon, Kyoochang Jeong, Heejo Lee

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    4 Citations (Scopus)


    Attacks using vulnerabilities are considered nowadays a severe threat. Thus, a host needs a device that monitors system activities for malicious behaviors and blocks those activities to protect itself. In this paper, we introduce PROcess BEhavior (PROBE), which monitors processes running on a host to identify abnormal process behaviors. PROBE makes a process tree using only process creation relationship, and then it measures each edge weight to determine whether the invocation of each child process causes an abnormal behavior. PROBE has low processing overhead when compared with existing intrusion detections which use sequences of system calls. In the evaluation on a representative set of critical security vulnerabilities, PROBE shows desirable and practical intrusion prevention capabilities estimating that only 5% false-positive and 5% false-negative. Therefore, PROBE is a heuristic approach that can also detect unknown attacks, and it is not only light-weight but also accurate.

    Original languageEnglish
    Title of host publicationInformation Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings
    Number of pages15
    Publication statusPublished - 2008
    Event4th Information Security Practice and Experience Conference, ISPEC 2008 - Sydney, NSW, Australia
    Duration: 2008 Apr 212008 Apr 23

    Publication series

    NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    Volume4991 LNCS
    ISSN (Print)0302-9743
    ISSN (Electronic)1611-3349


    Other4th Information Security Practice and Experience Conference, ISPEC 2008
    CitySydney, NSW

    ASJC Scopus subject areas

    • Theoretical Computer Science
    • Computer Science(all)


    Dive into the research topics of 'PROBE: A process behavior-based host intrusion prevention system'. Together they form a unique fingerprint.

    Cite this