The DOI matches its Crossref record; 16 of the 16 references it cites were found in a registry or an index.
Anomaly detection using call stack information
Open accessAbstract
The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from the call stack and effectively using it to detect exploits. In this paper we propose a new method to do anomaly detection using call stack information. The basic idea is to extract return addresses from the call stack, and generate an abstract execution path between two program execution points. Experiments show that our method can detect some attacks that cannot be detected by other approaches, while its convergence and false positive performance is comparable to or better than the other approaches. We compare our method with other approaches by analyzing their underlying principles and thus achieve a better characterization of their performance, in particular on what and why attacks will be missed by the various approaches.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Intrusion detection using sequences of system calls
Hofmeyr, S. A., Forrest, S., & Somayaji, A. (1998) · Journal of Computer Security · doi:10.3233/jcs-980109 · Cited by 1,313
StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
Cowan, C., Pu, C., Maier, D., Hintony, H., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., & Zhang, Q. (1998) · PDXScholar (Portland State University) · Cited by 1,278
Data Mining Approaches for Intrusion Detection
Lee, W., & Stolfo, S. J. (2000) · doi:10.21236/ada401496 · Cited by 1,179
Self-citationA Sense of Self for Unix Processes
Forrest, S., Hofmeyr, S. A., Somayaji, A. B., & Longstaff, T. A. (1996) · Cited by 1,150
Detecting intrusions using system calls: alternative data models
Warrender, C., Forrest, S., & Pearlmutter, B. (2003) · Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344) · doi:10.1109/secpri.1999.766910 · Cited by 1,106
Mimicry attacks on host-based intrusion detection systems
Wagner, D., & Soto, P. (2002) · Proceedings of the 9th ACM conference on Computer and communications security · doi:10.1145/586110.586145 · Cited by 714
Intrusion detection via static analysis
Wagner, D., & Dean, R. (2002) · Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001 · doi:10.1109/secpri.2001.924296 · Cited by 647
Combinatorial pattern discovery in biological sequences: The TEIRESIAS algorithm.
Rigoutsos, I., & Floratos, A. (1998) · Bioinformatics · doi:10.1093/bioinformatics/14.1.55 · Cited by 557
A fast automaton-based method for detecting anomalous program behaviors
Sekar, R., Bendre, M., Dhurjati, D., & Bollineni, P. (2002) · Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001 · doi:10.1109/secpri.2001.924295 · Cited by 554
Buffer overflows: attacks and defenses for the vulnerability of the decade
Cowan, C., Wagle, F., Pu, C., Beattie, S., & Walpole, J. (2002) · Proceedings DARPA Information Survivability Conference and Exposition. DISCEX'00 · doi:10.1109/discex.2000.821514 · Cited by 371
Cited by
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
Han, X., Pasquier, T., Bates, A., Mickens, J., & Seltzer, M. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24046 · Cited by 349
User re-authentication via mouse movements
Pusara, M., & Brodley, C. E. (2004) · Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security · doi:10.1145/1029208.1029210 · Cited by 283
NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation
Li, S., Dong, F., Xiao, X., Wang, H., Shao, F., Chen, J., Guo, Y., Chen, X., & Li, D. (2024) · Proceedings 2024 Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23204 · Cited by 45
Detection of Anomalies in Large-Scale Cyberattacks Using Fuzzy Neural Networks
de Campos Souza, P. V., Guimarães, A. J., Rezende, T. S., Silva Araujo, V. J., & Araujo, V. S. (2020) · AI · doi:10.3390/ai1010005 · Cited by 16
Metadata
- Authors
- Feng, H. H., Kolesnikov, O. M., Fogla, P., Lee, W., & Gong, W.
- Venue
- Proceedings 19th International Conference on Data Engineering (Cat. No.03CH37405)
- Publisher
- IEEE Comput. Soc
- Published
- 2004-05-13
- Pages
- 62-75
- ISSN
- 1084-4627 (ISSN-L)
- OpenAlex
- W2167332015
- Cited by
- 386
- References
- 16
- FWCI
- 25.59
- Type
- conference paper
- Language
- en
- Open access
- green
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Anomaly detection using call stack information. https://app.cochat.ai/papers/10.1109/secpri.2003.1199328
- The paper
- Feng, H. H., Kolesnikov, O. M., Fogla, P., Lee, W., & Gong, W. (2004). Anomaly detection using call stack information. Proceedings 19th International Conference on Data Engineering (Cat. No.03CH37405). https://doi.org/10.1109/secpri.2003.1199328
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
