HWP Document File V3.00 h7R":''' A Aaa G)cccc A Aaˡa ᤡ Linux system aw a ia waqA aa Linueba 1999e 8 12 a, 1 11W pTU!W3A$?32iD[Fdן*N:ę cHph^H;R,;N23+X[e2Q4~@3 ғf_Ùd ^+.\ʁO?J@t~u<*A# բ[sR(l([txIo›Ev!k-:92K ̯|36sk'ZP;uUsz[GP:fCN3/vm(.sxN﯆wˮۯ*srdҽ__C3hwee.M(񴜽;zydЄlg0E='aWKyrj~>X1b̈́w Xu`os"_~V_sPR#퀻Ӈo C#D ln%bmώW Rup:⃿X4Π(Ҭ{rUW0pܥӺ/~3GF7͇~8t "%\MjXIɇ9O𻄿nI :2n9{r[8?>5 hRbɟl^Z.+2P&ZC;G(d?XߞFjA~aRB*,~j͇[WI<00+~l%9p%TZt+)%R-s&]c~[ K`j9jc>,`$>Z@fTnpf-ɡ8?Ofl@'49o^Aq Xғ?\38_qY=IПe׌у7}dPe=2,iH -Uvy-칰t٨eTxoo<QVε{^4(uf̆~h@Ѐtu+'\ɫ|h~t |~j^|#ΧCW` õd M4mFS kg~2)rҡD Wz5>ܡj5XhA+F _]SQmCU%mnMDDQ4aSnjcF̰9Gdՙ ƞkd˯Bͪv;jxHvõ[hAV2juR5V¦Ħuc۩{Sx19'jw2.Xm_f3FHV]=k>j?b2#è wu2ެ .mUa~2vACkݶ`cAEþq,(KHHI[00_NY[fXYfXx& CW}ϓsRJg%dȞ;̨Xۦ}?hABD06eE2s`K>V^{1P>( ||%pt*p`:g&&`,`l`\]@w>h&.@WL[b2ܨ]6 or4RSW*˞rC{),1^m{2Bu:sk1N$DIOp93?u6d.tpn<^%H`ZWRC?FcS59*T2z#ͺFs=ZfQU:!jbT[ZXPYR9Fť:hH8UI}cԮKSQ5*Zl=U͢+0;QH*'!jЈѵ"O.t̄ya|es":%M*|LxC_ҏp)k% Ty"qvN1;&-]HZI7k>XJ8KKƗk*uy&!<]㏯" +D.HKv  P~JJ~z_ L(j# dٱ@;NL- /I_F][3]ju˸] #&_oWa3E|LªNNHl"ρVj]L:eol5 H Zfޭ`>f%BވwN<KRhi0ǹ:'.F(V]#;ՍԠY'A'0Pf&1=v>ޭUwǔnؠY\qn4jT[xF0wij،}Sy*}YuV‰J+Puzt}݅`KtTI3.fd#B$ȮV.~X#2J=w9G8]*g@[>c2PHnU6NoN6 HTVUv@YAC P}էVjIQ(Xed' VvnkGz:ol?W?_7U_ӂU‚Uj*)䅈@T4yOhq^&7mEIWG{fo61, p (x} ˁyU5@z1 Œd`%{uz>jv{nQ4 ҽrzRzR-q%'jJy=E!|r?~q8uE U^i +v^{]&WW%6pעeTCZj ]hr)ƊޭdEKjԺ:]7HYBz*4/z0 PIG S/o%@tHmӕJ IS`L[[:vʭ>x$ p;E{¾H;D ({V+ZLDvw Kgp_f 5@h wl9"ULOZV{@T )PU!K k:mUlmwfڝ ^!l@mV[ 9!ѽtkţt`t;}ig$xڍ79'~T$b7;4}daӻO{p>z9PnVaFjKKӲ e9й#T"uO邙ZגanR3)׍Z{\FhqU(o՞є>{<œr-=c(mktAb=:kQ1L4urm&4ARɭ=&H =uQՎHP^ ҺFTƙ.x$i =֏B26d&4}cqJǍvvuJ0GFL0ֶg5݊Pq+av~sxu*/ē@QƛvZnmє~*i2+xgZŅ 5)$oRb_Ii5?Ah⩜|oI|ƿM FT6h 蜎a7/aN'*qsҨ[eo*=}ɴ7u$1{!-҆;$3{ٳsyթOjm#Ӈ6(=mw l׳rDz3l#)U'JAiNTBJGiߠTRv *ygJ:Y * L;WK~T)ZzV8Pr ZU0?mmۜX/MҒ2Ʌ[]׈!^JtJgĬeDl$MIh&.,^̫J֧K[i?e# Zgfd$DGGtx =(Tį{5qIj;^&^:"5ל['P07nwnͨ\LNk{ʟk%zqJù8*MGVDy(uTEΊk.ЃˆqgqqLB ܐ;8+qh[X5evX׍e}{Ӑ[3znsoBvck#i+D&ck';0vc|Y>uN- D~R {31mD5_aa~ {pp#F8ǂ0y+tbicjto8?=~Zp# ӶO7{-P?Z gN݉ QH}o#wWtT^Q-+=asPVՠY%c>كQ4A_@1s4K[OB;AQ>f{9:? 0RQ2u18~@PFşCw@:*ð35VT|;3$^oō((4*ֿYnQ'꟧LKql!PPCw#K~ޘ2WT;Z *`^cT>\8_mx-!1^Xz 0Y w.p21ٶd`~k'^¾"í-m9k9oJ/יf)K,/pѨV?<N0*doU Y(fsjUj0?9Sd_Vq%Ҍ߮9S SD7AlcoGgD zVa *2i8hF 2\1"':QիD]'̍"LknEYzH߻E=+JҘҸL[ 2~ >\3ڳhcgl-$[9i =ERs`xVpNl6Om#2AIDDSDͣDgђD$vVTT~?ΡScy'T,x 6inGX}ouv;sjDܙODbQf|qP-č&v1d Or?,IB 45Iz*󑚥/Գu/f5zg4;hMg'WԘMݦv_@LSχ5U k'hj_hEP 3@C̽RS⌭Hm&V?U弦hWktl@SxMU{1[vIe戴e؇븞<ɗW̹89NqR o圊o##2m{{G)Tenʩ_%3o&ũɖҖfVo}(lrpkޞ}S&VofsC[6λs0QTIV~.C 1QYM }m+q2x;ݍJ-sNI"_lwhGNOr,!wd5M2y&mTX,Q)Cw%"yDhKYUIQFw}) Ze6z5TީLr%Ad8Ɍ;"szg=O:݁^'=XZĩ MtjJ[ n([,VCkݴews˪7XUynN蜖nZwmXtJX7YAi[MZHQjZ[O;jT 퉜)T;q}xDYGo_UE :۟ ;[ҁH?ZSUZM͒z:M%\j4[FMGl&MCh1̍lST|4d2Ku;J/3$ď#::u&|Syѻue֪!\7>G`6^,Dw_i m> ǸJOqx`ce?;1>0пҝXyXDT֓36RޛkjMTUoPy#sSytr%\ҲVԗZ- )5݃7dƽ\)Z`n(]z-]z:bӹQQ]S͌Ljc+By,g"*݂xHrNšz{^/M%U[Sj.PS*T/U؍ﯩ᠞l 03tb]{rI3xe?$S )!Szg,S8v ?xL~oV֦VE_=3 pu/.KX;]D xrvWrgҪJu*vaHŀLk_'l@Iy=w*RuxDRY]b5lUunz1|(t fyk"vm?pn~v\ M]Tz)}KE֐Onv%CD8KdPIEF)X1"':QիD]'̍"Lknw{"'AW1q@de]a.w E@w#ʺ @VͰs̶*<ط|yEZaAŠ W_}`!䥊3ο VM:\ay /sao6I^ޛA<>"\^*;zޖS/SD9|9 {alm${0վt9N^w<`N~;I4!x[%t+2R a a.þ²FcQS}EޅG=/17lG40 9Rݩ+ÙC&9y;1 1~/п ꐞcnmj.pgU,$كQL/B-'3~ S0瘽~~,.\Y0=LA1/-/_xQq&ˌeV RQb܅1K[ G2ENT_ w\w .eO5վ|mkD|̂4=gQ|QT8W~"Sqk(*1]=A==UsI" =SYƨЏfCSTf_ a]yv;ʮ|Tv.j@|>s ]K0fiH_xK{PR <~ً"OyḘxV^*B̧vVe"Sr"ނ$ 7KۺYͅs2Z]+7,"?i(Ǯ xV^ofH b?bE'o-7Ƽ_τ51ey/X,:Kpߢs4c|)zvyzOIa%`-lPi_ڗ&Y9]Y'd`>[b#5d:E!ē~BlƈLqXzwDͣDgђD$vVTDkߐ!%OF޾vuQ|scQ,jɕ}@(bqQ_ (ɹn<_Sw(+ Bc8CrLbzLRxoZZ%wҞibWxsF\N dV fÛ{*Ez锸.RpH{iʶթǍHm&2Qy黶Ʒ0:;u&'dSq\# ~5yR4]395 jܮДPn.҈FP/ԭ2QzT5FS+cDS//|x22M znx΄N'9C{.s7h_C\ ]>Yp+m r.eHfGLlZ~>.h&}8Di~-rO% 8>"MX[,N߲/qr."l,nx-N;er"pr$uǻ}hEKXw4n/(đIy[W .(rN&>uouxِ+r2lx▶ln ʜ Z85)dGڲnJGv&gf0tԳjr G!+^h;{k_X;X+}Uu’CnԈΗ3>JSSUsXĵz4]g%uTjVECq@PI%[gaRU{2C%Yh:4dYH;>߱&B KF9Agunהʸa]42:7tZ¥ISt^U2 ָԸ8z̫,gW;2&`BZA"䜙ih$}Jh遬Eh=g7NK$Ll8= d0bfNpvM`JK!˅qAH~޵fY$tee%UuJOK׷+Kp_Xd@2QvKH$ee%UVy B`*X]Y 4Oflp VqfXV X}BX ""K<@da߬sD!~HhD6^$REf\)2~E>QL}E4DmD&,]a*m6yB=k"2W q,B<_(+@G|PDL;%U՛Kb/GP u`w(MS3FA?1#󛸜7r1wR`u7U\ow q"¡0ߥ25ej_N%U #jM 1) e|"ܥC,"+ Q7PVdegYW$YYCueBYu, GŨS*򙖕/$OFKBUL#܅H>TSU |)Oʘj#Z"<8)ZUz z5]0(B>ԔȬ,EEQXSUY( !(D!)hiǩM:Ӆ F ci3.*gOD3Z'ށU5_/܁LBG"MdVQ3+j|V~V.m-{nԑ,Ҟ&SHEȒ"70DdY"Y|1B<";ljlHd" &̸RdT5"׋|vȡ"f Xu_!u  {P/:=Kd?J >xD {)sm!V%d*n5-M]n*Jߴ}D|jzE %}9'>Dҋqn|wl9Ϫ˭ ۹ QޅJL5fh&m&ʹ}#Ť U3'V3|!hOd!) 'X&q38''Ϛ8)~TS0Xw ӠA|qO>.1Fۥ g:P+uj,} 47n/R`vO=NN KQ.,6Z*K-i>X0q{XMЦA ۳ Kr| q|1y1bxlCB00=ǜmfu_c h_IrOj]Bb p+D^x<|OH_G?l׌D׀U:U!ܶ-5Ac+N(c&HvXUXfQOcL 9S 6 hG5꠴,~aPR-E"j1o0n̥}ars(LyԮY;Ssc{g~gf:U |2s῿3 f !׌zf9Z%MjN3& `Jm S)IF_b[ao o>_)a%ׁp}Kh=Mt3N% >-OXY(+^?<藰%Yx#)}1}hϳTIL̳d q1P$r"$%"#Kqif L.KN7 Aoċ%E4ז5̱VQ`}wj*|[ ,lWz6bI]j)dL]}:<%ZD2]IC'ԩfTgfFSM;0S-TUV9T G I}n8/e{dP `ۙx">A͸v~V?KӃ$nHOե'dͱF .W1Sa >缢JVFWwL-e`.χWl>.Ux&{ogΔ)Lɜgd+7-(YFFfө܂Viz}% fE]vlgbHU|Ӵǣ"|Vn]~NUz4 ܟGǢ]?P-sƹWa t|;3}9uY 3 BqƱo̹Ȇx1[l8zNpOE\FijB s&a.}s>w}H@KюiE>cc3l8pxx7?H{:P?@}کn9Eؾ>e>e1Ifn u[:z ,ў^.t2Xs?iꋕ-FK/:.7&0Dhb ϺhSYv;0f<*1< {Wna0g py! 'ԝG@5<3 2䇖Hc cϥQہum8߆m6x/GE${Էsrl9*e^w܇N۹bjy̽p>p25<sy%"`y-K:Olux;O>Bn=g;h Ud,Ay!X,sD!~Hh"REf\ Ǟ*sg7")o6HFQ$rv4 ]v62YMU 8#78ߜdo\ԇF=QqOTcLSO3qO]qaSԋ:풸E4ۗ=uPAԁV(6E%`ތ5x$_#HϗR֋iHIG;׽;xs87U@NZ).-c^w&Wnbk-=HsuxwV~RjըӰCܳdzo tNbPT eؑ[o\E;'{$Sٕ˷IJHc=0zԵ v<2ݴRd}xXͪ@n#оVJHyYRF.ka@V*6yNdcM`Q:M_OmߣZjLOllx ʺȝc^z1E0F}Y2Jf#2 w*x+7Lʧ T8rA]؜1f,m012y2RJ<~FUE*jTQ0<(6tZ _Pv*0ҟq: +`hbLcB…+CX4(K]Y9+7:s[Š諾w=s|7SԝWR`P7ד8|$у <>+GeLp/%ch']9q̉=a~MmT\u~2\ua P%4%Ϡ4JWeJmw@+E /K : +)<>>Y?zyP.o @W ;tUIYV,Z2&9x=_g5*Oas>ЎsE)tUm̀x䘁ߢL(F]wS 3+@4@ƗBME̴:CJ>%1"(a7\0$F?ְ bUiO9(H\| Hόpy#ëf6 ndxXP8J(󗬴+9mz8Ջ]s2r(M8c:h >/ds>aG{rRqi$i$BܻI3@L*A igD:%jV0Mq3/0mX:eQɛ8o-C`\ D׭Vr;nVYѝY-8q4hkU/E^ C8=iJC>~gN+o!Rbb`gzմvoꥯS[FўS_BR"Ƅɂ28vdR'TS'G  aB`z%A{!GĿT5  . F8gxag#aG=ٳ`P(< \{7׹JV\SfiI0GZ垥6+Z~qTۤ{@6[wXtu~UE۾ǜ^@91S;OC+q̣Y4wxwΓױÍ AlOͪ_/G$‹52$eS%qm{ $"z %mѐLX }|HcdR~9TA /!>ya#oҸ`"Y| J/m8sG^r0'T qei}J i]'a WK5Fi$ocY3x]o ? gP3z&Cճ|&n{mV#]1Q/iw?'rf"{vl-Gȭvak]"K"^Eu\7D|K$n 9gD#ҹ *u )6KjeZ+,MuYy 㢷x*Kޠ&Lqymx!{m-9/pEWNBMN6(tPJ@ @ @@@@@`@```@@@@ @ @ @ @@ @ @ ` @` ` ` @ @ @ @ @@@@@ @@ @ @ @@@@@@@@@@`@@`@`@`@@@@@@@@@@@@@@@@@@@@@`@``` `@ ` ` `@`@@`@`@```@```````@````@````@````@```@ @ @@@@@`@```@@@@@ @ @@@@@`@```@@@@@ @ @@@@@`@```@@@@@ @ @@@@@`@```@@@@<><aQ щ i e Linux aQAᬁ ó qȡ><> <> <>< , A eba eɁb><> <> <><Intrusion Detection on Linux System via System Call Traces ><> <> <><Dongcheol Shin, Seongje Cho Dept. of Computer Science and Statistics, Dankook University ><> <> <><a Ae Linux aQɁ aw sb waqA aa Linux aQAᬁ e e A aa aA e wa ó qȡ wi aa a a wei a a. aa ó qȡ w aQɡ ɮa ww A ᴡa w óaa a ɮ e ww wi Aҡae a aw ᴥae e񸡷 a. aa Ae Linux aQɁ A wwi aQ щ i aa ói qȡaС ei wѡa e aQɥ LiSID(Linux System Intrusion Detector)i Aeava. ><> <> 1.ᬥ A A Linux aQɁ aw waqA aa Linux aQi wa ae ó a waaС a. óe a i(integrity), (confidentiality), aw (availability)i ҥa ae e зa Ea[7]. aQA ee awaA e ói qȡ(detection)ae we w qȡ(Misuse Detection) e qȡ(Anomaly Detection), a a a. w qȡe A ia aQɁ ¢񸡷a ó wi waa aQA óae i qȡ e i iaa, e qȡe w⸥ (normal behavior)A ae (anomaly behavior)a i w ó ai iae i iea[3]. w qȡ aQae COPS, SATAN, STAT, swatch w aa i aQe ó iaa aq A qȡ aQɡ I a qȡa e A(COPS, SATAN w) i a ieE aQɁ ¢i qȡ aQAA iaae a ói qȡ aa, qȡ aQA wA e ae w󤁷 ó i w iaa sae e񸡷 a[5][6]. e qȡ aQae IDES w aa IDES w awaa aϡa awae CPU, I/Ow aQ bi ea aС A ᬡ ae aQA e waСa sae e񸡷 a. e ɮa aϡa ó qȡ w aQɁ w óaa w ɮa aϡai Aҡae a aw wEae ei aa. aa Ae Linux aQA óaa ó awaA Ae a aQ щi A ʼnqa w qȡi aС, aQ óA aw I e aϡaA aa aQ щi , qa e qȡi i e aQɥ LiSID(Linux System Intrusion Detector)i ava. 2. LiSID(Linux System Intrusion Detection) w LiSIDe A ia wi awaa ói i w i aQ щ A q, aeae w qȡ aQɥ LMD(Linux Misuse Detector) aa óA awI e aϡa aQ щi , qai aa e qȡi ae LAD(Linux Anomaly Detector) ᴥa. 2.1. w qȡ(Misuse detection) w qȡe iaa e b wi waa aQɁ ¢i xa óae i qȡ e i iea. A ae w qȡ aQɁ w ʼn⸡ awaa awaС ae w񸡷 aa e aA aa bb С ae sqС a. i i Aaˡai e óA eӡ awAe .rhostsA e s⸥ e w sendmaila passwd aϡa ¢i awae w ó w󤡷 eA w w qȡ aQe iA aa bb i i aa ᴡ ea. a i sendmail ¢i waa .rhostsA eae wA aС aa sendmail ¢i w qȡ aQA iae e i passwd ¢ b qȡ aQɡ a ᴡ eae a. |a