-1

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys

  1. Can a rootkit be classified as an intrusion or is it a malware or both of them ? What's the difference between intrusion and malware then?
  2. Can a systemcall sequence determine that there is an intrusion in the system? Or invalid syscall sequence only can detect malware.
  3. If I would like to monitor syscall, Can I do it at the userspace for example using systrace or it only can be done in kernel space ? What's the best method possible?
Ramandika Pranamulia
  • 11
  • 1

1 Answers1

0

Can a rootkit be classified as an intrusion or is it a malware or both of them ? What's the difference between intrusion and malware then?

A malware by itself is not an intrusion. But if the malware has infected the system then you have an intrusion. But there can be intrusions without malware, i.e. logging in with stolen credentials. And a rootkit is just a special kind of malware.

Can a systemcall sequence determine that there is an intrusion in the system? Or invalid syscall sequence only can detect malware.

Usually not fully determine, but only suggest. If the sequence looks similar to known malware or if specific files are accessed, if the registry is changed... then these might all be indicators of potential malware. But it might also be non-malicious software.

I would like to monitor syscall, Can I do it at the userspace for example using systrace or it only can be done in kernel space ? What's the best method possible?

In Linux you can use the ptrace syscall to trace other processes owned by you (and only these). Or use the strace command or similar command in other UNIXes like truss or ktrace.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
  • Hai thanks steffen for your answer, I would like to ask more about the abilty of systemcall tracing to detect intrusion like port scanning? Is it possible? If yes then what thing should I trace its systemcall? Or basically systemcall is just for malware and rootkit detection? – Ramandika Pranamulia Jan 07 '16 at 17:28
  • @RamandikaPranamulia: No syscalls are involved when somebody outside the host is just scanning the ports of the host. Syscalls are only involved if user space needs something to be done by the kernel (i.e. open a file etc). – Steffen Ullrich Jan 07 '16 at 17:33