Continual repair for windows using the event log

摘要: There is good reason to base intrusion detection on data from the host. Unfortunately, most operating systems do not provide all needed in readily available logs. Ironically, perhaps, Window NT and its successor, Windows 2000, much of necessary data, at least for security events. We have developed a host-based detector these platforms that meets generally accepted criteria Intrusion Detection System. Its architecture sufficiently flexible meet largely by relying native mechanisms. Where there are identified gaps event log, they can be filled other sensors using same event-logging interface. The IDS will also terminate unauthorized processes, delete files, restore deleted or modified files continually without lengthy recovery due compromise. call this feature Continual Repair. It an existence proof self-regenerative possible.