Modeling Distributed Network Attacks with Constraints

In this work we demonstrate how to model and perform the detection of Distributed Network attacks using NeMODe, a declarative system for Computer Network Intrusion Detection which provides a declarative Domain Specific Language for describing computer network intrusion signatures which span several network packets by stating constraints over network packets, thus, describing relations between several packets, in a declarative and expressive way.