Earticle

초록

영어

In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user’s activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.

목차

Abstract
 1. Introduction
 2. Motivation
 3. Adding instrumentation to open-source
  3.1. GCC Modifications
  3.2. Performance Impact
  3.3. Open-source demonstrations
 4. The IDEA monitor
  4.1. The domain specific language
  4.2. The monitoring facility
  4.3. Specifying function traces
  4.4. Automatically learning typical behavior
 5. Conclusions
 6. References

저자

• William Mahoney [ Peter Kiewit Institute, University of Nebraska at Omaha 6001 Dodge Street, Omaha, Nebraska 68182-0500 ]
• William Sousan [ Peter Kiewit Institute, University of Nebraska at Omaha 6001 Dodge Street, Omaha, Nebraska 68182-0500 ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605