Network intrusion detection

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators. The intrusion detection problem is becoming a challenging task due to the proliferation of heterogeneous computer networks since the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to avoid identification. Intrusion detection systems (IDSs) are based on the beliefs that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. Typically, IDSs employ statistical anomaly and rulebased misuse models in order to detect intrusions. A number of prototype IDSs have been developed at several institutions, and some of them have also been deployed on an experimental basis in operational systems. In the present paper, several host-based and network-based IDSs are surveyed, and the characteristics of the corresponding systems are identified. The host-based systems employ the host operating system's audit trails as the main source of input to detect intrusive activity, while most of the network-based IDSs build their detection mechanism on monitored network traffic, and some employ host audit trails as well. An outline of a statistical anomaly detection algorithm employed in a typical IDS is also included.<<ETX>>

[1]  V. Voydock,et al.  Security in high-level network protocols , 1985, IEEE Communications Magazine.

[2]  S. E. Smaha.  Haystack: an intrusion detection system , 1988, [Proceedings 1988] Fourth Aerospace Computer Security Applications.

[3]  Gunar E. Liepins,et al.  Detection of anomalous computer session activity , 1989, Proceedings. 1989 IEEE Symposium on Security and Privacy.

[4]  J. R. Winkler,et al.  Intrusion and anomaly detection in trusted systems , 1989, [1989 Proceedings] Fifth Annual Computer Security Applications Conference.

[5]  H. S. Teng,et al.  Adaptive real-time anomaly detection using inductively generated sequential patterns , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[6]  Peter G. Neumann,et al.  IDES: A Progress Report , 1990 .

[7]  Biswanath Mukherjee,et al.  A network security monitor , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[8]  B. Cheswick.  An Evening with Berferd In Which a Cracker is Lured, Endured, and Studied , 1997 .

[9]  Biswanath Mukherjee,et al.  Detecting intrusions through attack signature analysis , 1991 .

[10]  Harold S. Javitz,et al.  The SRI IDES statistical anomaly detector , 1991, Proceedings. 1991 IEEE Computer Society Symposium on Research in Security and Privacy.

[11]  Steven M. Bellovin,et al.  There Be Dragons , 1992, USENIX Summer.

[12]  Biswanath Mukherjee,et al.  Analysis of an algorithm for distributed recognition and accountability , 1993, CCS '93.

[13]  Tom Burr,et al.  Software Toolkit for Analysis Research (STAR) , 1993 .