Combining Techniques from Intelligent and Decision Support Systems

This paper presents the design and development of a prototype of an expert system application for the detection of certain types of abnormal behaviour in open networks (and in particular in the management systems of such networks) and shows how it provides decision aid for the System Security Officer (SSO). The objective is to aid the SSO determine the seriousness of the possible attack and also to help him to find and apply the appropriate countermeasures. The case of unknown attacks is discussed here, where the SSO has to consider a number of constraints. Sets of actions acceptable by the system but which at a higher level may form a non acceptable task or tasks are assumed to be detected by the User Intention Identification (UII) module as potentially malicious intentions. The Decision Module (DM) is, responsible for aiding SSO with his decision regarding possible intrusion detected by the UII module. These two modules are presented and discussed and the way these two modules communicate is also introduced. This work is carried out under SECURENET, a project that aims at the protection of networks and in particular their management. The development of the current version of the modules was carried out in the frame-based expert system-shell CLIPS.