A Pattern Matching Model for Misuse Intrusion Detection
نویسندگان
چکیده
This paper describes a generic model of matching that can be usefully applied to misuse intrusion detection. The model is based on Colored Petri Nets. Guards define the context in which signatures are matched. The notion of start and final states, and paths between them define the set of event sequences matched by the net. Partial order matching can also be specified in this model. The main benefits of the model are its generality, portability and flexibility.
منابع مشابه
A Software Architecture to Support Misuse Intrusion Detection
Misuse Intrusion Detecl.ion has traditionally been understood in the literature as the detection of specific, precisely representable techniques of computer system abuse. Pattern matching is well disposed to the representation and detection of such abuse. Each specific method of abuse can be represented as a pattern and many of these can be matched simultaneously against the audit logs generate...
متن کاملIntrusion Detection: Challenges and Current Solutions
The problem of intrusion has been a long standing computer security challenge. With governments and institutes relying more on computer networks it is becoming essential to arm networks with defenses against intrusion and misuse. Such intrusions include installing harmful viruses, spreading worms, initiating distributed attacks, and misuse by authorized users. To defend against these attacks, s...
متن کاملA Pattern Matching Based Filter for Audit Reduction and Fast Detection of Potential Intrusions
We present a pattern matching approach to the problem of misuse detection in a computer system, which is formalized as the problem of multiple approximate pattern matching. This permits very fast searching of potential attacks. We study the probability of matching of the model and its relation to the filtering efficiency of potential attacks within large audit trails. Experimental results show ...
متن کاملA Hybrid Framework for Building an Efficient Incremental Intrusion Detection System
In this paper, a boosting-based incremental hybrid intrusion detection system is introduced. This system combines incremental misuse detection and incremental anomaly detection. We use boosting ensemble of weak classifiers to implement misuse intrusion detection system. It can identify new classes types of intrusions that do not exist in the training dataset for incremental misuse detection. As...
متن کاملComprehensive study of different pattern matching intrusion detection techniques
Today, at very large scale the internet facility is being used by the peoples. The misuse of information, hack the confidential information of the users, confidential quotations-cash, Ebanking and even in government confidential records are trying to fetch by hackers. Now we need to develope such system which detect those attacks rapidly and inform to the user. With the intention, the user will...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 1994