Browse > Article
http://dx.doi.org/10.3837/tiis.2014.03.014

A Process Algebra-Based Detection Model for Multithreaded Programs in Communication System  

Wang, Tao (College of Information Science and Engineering, Yanshan University)
Shen, Limin (College of Information Science and Engineering, Yanshan University)
Ma, Chuan (College of Information Science and Engineering, Yanshan University)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.8, no.3, 2014 , pp. 965-983 More about this Journal
Abstract
Concurrent behaviors of multithreaded programs cannot be described effectively by automata-based models. Thus, concurrent program intrusion attempts cannot be detected. To address this problem, we proposed the process algebra-based detection model for multithreaded programs (PADMP). We generate process expressions by static binary code analysis. We then add concurrency operators to process expressions and propose a model construction algorithm based on process algebra. We also present a definition of process equivalence and behavior detection rules. Experiments demonstrate that the proposed method can accurately detect errors in multithreaded programs and has linear space-time complexity. The proposed method provides effective support for concurrent behavior modeling and detection.
Keywords
intrusion detection; concurrent behavior; static analysis; process algebra; system call;
Citations & Related Records
연도 인용수 순위
  • Reference
1 N. R. Tallent and J. M. Mellor-Crummey, "Effective Performance Measurement and Analysis of Multithreaded Applications," in Proc. of the 14th ACM SIGPLAN symposium on Principles and practice of parallel programming, vol. 44, no. 4, pp. 229-240, April, 2009
2 N. R. Tallent, J. M. Mellor-Crummey and A. Porterfield, "Analyzing Lock Contention in Multithreaded Applications," in Proc. of the 15th ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming, vol. 45, no. 5, pp. 269-280, May, 2010.
3 J. A. Joao, M. A. Suleman, O. Mutlu and Y. N. Patt, "Bottleneck Identification and Scheduling in Multithreaded Applications," in Proc. of the seventeenth international conference on Architectural Support for Programming Languages and Operating Systems, vol. 40, no. 1, pp. 223-234, March, 2012.
4 J.H. Morris, "Lambda-calculus Models of Programming Languages," MIT, Cambridge, MAC, U SA, 1968.
5 H. Bekic, "Towards a mathematical theory of processes," IBM Laboratory, Vienna: Technical Report TR, 1971.
6 G.J. Milne and R. Milner, "Concurrent processes and their syntax," Journal of the ACM, vol. 26, no. 2, pp. 302-321, April, 1979.   DOI   ScienceOn
7 D. Caromel and L.A. Henrio, "Theory of Distributed Objects," Berlin:Springer-Verlag, 2005.
8 D. Caromel, L. Henrio and B.P. Serpette, "Asynchronous sequential processes," Information and Computation, vol. 207, no. 4, pp. 459-495, April, 2009.   DOI   ScienceOn
9 L. Cardelli and Gordon A.D, "Mobile Ambients," Theoretical Computer Science, vol. 240, no. 1, pp. 177-213, June, 2000.   DOI   ScienceOn
10 L. Cardelli, G. Ghelli and A.D. Gordon, "Types for the ambient calculus," Types for the Ambient Calculus, vol. 177, no. 2, pp. 160-194, September, 2002.
11 R. Milner, "A calculus of communicating systems," Lecture Notes in Computer Science, Springer-Verlag New York, Inc. Secaucus, NJ, USA, 1980.
12 J. Hopcroft, "An nlogn algorithm for minimizing states in a finite automaton," Theory of Machines and Computations, New York: Academic Press, January, 1971.
13 C. Hoare, "Communicating sequential processes," Communications of the ACM , vol. 21, no. 8, pp. 666-677, August, 1978.   DOI   ScienceOn
14 Wenke Lee and Salvatore J. Stolfo, "Data mining approaches for intrusion detection," in Proc. of the 7th USENIX Security Symp. San Antonio, pp. 26-29, January, 1998.
15 D. Wagner and D. Dean, "Intrusion detection via static analysis," in Proc. of the IEEE Symp.on Security and Privacy.Oakland:IEEE Press, pp. 156-168, May 14-16, 2001.
16 J. Giffin, S. Jha and B. Miller, "Efficient context- sensitive intrusion detection," in Proc. of the 11th Network and Distributed System Security Symp. San Diego, 2004.
17 R. Gopalakrishna, E.H. Spafford and J. Vitek, "Efficient intrusion detection using automaton Inlining," in Proc. of the IEEE Symp.on Security and Privacy. Oakland, CA, IEEE Press, pp. 18-31, May 8-11, 2005.
18 FU Jianming, TAO Fen and WANG Dan, "Software behavior model based on system objects," Journal of Software, vol. 22, no. 11, pp. 2716-2728, November, 2011.   DOI
19 H.H. Feng, J.T. Giffin, Y. Huang and S. Jha, "Formalizing sensitivity in static analysis for intrusion detection," in Proc. of the IEEE Symp.on Security and Privacy. Oakland, CA, IEEE Press, pp. 194-208. May 9-12, 2004.
20 S. Savage, M. Burrows, G. Nelson and P. sobalvarro, "Eraser: A dynamic data race detector for multi-threaded programs," ACM Trans. on Computer Systems, vol. 15, no. 4, pp. 391-411, November, 1997.   DOI   ScienceOn
21 D. Schonberg, "On-the-Fly detection of access anomalies," in Proc. of the ACM SIGPLAN Conf. on Programming Language Design and Implementation (PLDI). ACM Press, vol. 24, no. 7, pp. 285-297, July, 1989.
22 E. D. Berger, Ting Yang, Tongping Liu and Gene Novark, "Grace: safe multithreaded programming for C/C++," in Proc. of the 24th ACM SIGPLAN conference on Object oriented programming systems languages and applications, vol. 44, no. 10, pp. 81-96, October, 2009.
23 L.Q. Wang and S.D. Stoller, "Runtime analysis of atomicity for multi-threaded programs," IEEE Trans. on Software Engineering, vol. 32, no. 2, pp. 93-110, February, 2006.   DOI   ScienceOn
24 K. Deguang, Tan XB and Xi HS, "Hidden Markov Model for Multi-Thread Programs Time Sequence Analysis," Journal of Software , vol. 21, no. 3, pp. 461-472, March, 2010.   DOI
25 Z. Rakamaric, "STORM: static unit checking of concurrent programs," In Proc. of the 32nd ACM/IEEE International Conference on Software Engineerin, Cape Town, South Africa , vol. 2, pp. 519-520, May 2-8, 2010.
26 S. Forrest, S.A. Hofmeyr, A. Somayaji and T.A. Longstaff, "A sense of self for UNIX processes," in Proc.of the IEEE Symp. on Security and Privacy. Oakland: IEEE Press, pp. 120-128, May 6-8, 1996.
27 S.A. Hofmeyr, S. Forrest and A. Somayaji, "Intrusion detection using sequences of system calls," Journal of Computer Security, vol. 6, no. 3, pp. 151-180, January, 1998.   DOI
28 P. Helman and J.Bhangoo, "A statistically based system for prioritizing information exploration under uncertainty," IEEE Trans.on Systems,Man and Cybernetics, Part A:Systems and Humans, vol. 27, no. 4, pp. 449-466, July, 1997.   DOI   ScienceOn