Outbound Intrusion Detection

This paper describes a variation to the traditional intrusion detection approach motivated by longstanding challenges and recent trends in information security. Intrusion detection systems have historically focused on the protection of local resources by identifying signs of malicious activity that may help administrators prevent a break-in and limit its effects. Outbound intrusion detection focuses, not on preventing a host from being compromised, but on guaranteeing that the host will not be used as an attack launcher or intrusion relayer to compromise other systems. This approach leverages the quality of evidence available to a host regarding its own activity, and supports the idea of splitting up security monitoring into multiple, smaller tasks. We explain the motivation behind this idea by describing some limitations of intrusion detection technologies as well as some findings from security surveys. We also discuss the most relevant characteristics of the approach and outline the benefits it has from a research perspective.