"Good work on that report! The customer was super impressed!" There seems to be a trend in your boss' tone of voice versus the amount of work he is about to assign to you... "They were so impressed, in fact, that they wanted you to create a hostbased IDS for them that can monitor the behavior of a program they wrote." That doesn't even seem like part of your job description, you think to yourself. "Just make sure you can report on the malicious activities it does." Your boss also seems pretty fixated on this two-week cycle, you think as you start Googling for more documentation Actions . VM link: OneDrive: cs6264_lab4.ovaLinks to an external site. Google Drive: https://drive.google.com/file/d/1Q8Dltf24uCkTIEFkteDkp_iWXzOHm1G/view?usp=sharingLinks to an external site. md5 checksum: b92c8108ab2dae20b7ccf2bff63cfefe cs6264_lab4.ova Supplementary Materials Assignment Please implement an IDS on the provided VM that can report on the syscalls that are being made by the binary. As a hint, you will want to implement this by implementing syscall hooking. Deliverables • The C file and other files for compilation with an implementation of the IDS in the form of a .tar.gz package. • Part 0: A file with an example trace from your IDS. You will need to show the full path of any new directory you make mkdir create • Part 1: A file with the output of the IDS when the program is run with malicious inputs. • We will be checking these parts with the code as well, so don't just fudge the output :) Some Rubric Some Rubric Criteria This criterion is linked to a Learning OutcomeFirst Syscall Hooking This criterion is linked to a Learning Outcome21 Syscall Hooking This criterion is linked to a Learning OutcomeAnomaly Detection This criterion is linked to a Learning OutcomeBonus • A WriteUp on how to compile your code and your clever design of the IDS Rubric • Part 0: Hooking your first syscall - 30pt • Part 1: Implementing Anomaly Detection o System Call Hooking - 2 points per required hook - 42pt o Anomaly Detection - 28pt • Bonus: 5pt Rubric
