1. Colored Petri nets as the enabling technology in Intrusion Detection Systems Andrey M. Dolgikh MS in Computer Engineering Degree and Specialization Sought: Doctor of Philosophy in Electrical & Computer Engineering

2. Signature database Conventional antivirus Perfect match – virus detected Program _____ BRAKEITBRAKEIT Match Virus

3. Part of program Virus body detected Signature BRAKEIT BRAKEIT

4. Part of program Signature BRAKEIT BRaKEiT

5. Utilization of binary signatures (source: Kaspersky Lab) Current IDS depend on ever-growing databases of binary signatures

6. Utilization of Malicious functionalities (source: Trend Micro Inc.) 2007 2008 2009

7. Understanding behavior Sentence: – Send the password to the Internet Words: – Password, Internet, The, Send, To Letters: – PasswordInternetTheSendTo

8. Behavior File Objects Memory Sections Handle 1Handle 2 Handle 1Handle 5 System Service Executive Kernel mode User mode Operations System Calls API1 API3 API2 API6 API7 API calls Open/readCmd /c dirOpen/write Functionality level VirusMS Excel somesswordsendint usefuthingpaldoernet something password useful do send internet MS Excel: Do something useful Virus: Send password to Internet something do useful password send internet In natural language

9. Call #8 Chain 5,11 Call #22 Functionality Call #11 Call #5 Functionality: How to model functionalities? - Via CPN. How CPN works? – it assembles appropriate system calls into functionality

10. Questions ???