An Approach to UNIX Security Logging

Published: Feb 21, 2000
Updated: Feb 21, 2000
Section: Network Security Library :: Unix Security
Author:
Printable Version
Adjust font size:
Rating: 3/5 - 3 Votes

Off-line intrusion detection systems rely on logged data. However, the logging mechanism may be complicated and time-consuming and the amount of logged data tends to be very large. To counter these problems we suggest a very simple and cheap logging method, light-weight logging. It can be easily implemented on a Unix system, particularly on the Solaris operating system from Sun. It is based on logging every invocation of the exec(2) system call together with its arguments. We use data from realistic intrusion experiments to show the benefits of the proposed logging and in partic-ular that this logging method consumes as little system resources as comparable methods, while still being more effective.

Click Here to download this article