Using internal sensors for computer intrusion detection

摘要: This dissertation introduces the concept of using internal sensors to perform intrusion detection in computer systems. It shows its practical feasibility and discusses characteristics related design implementation issues. We introduce a classification data collection mechanisms for At conceptual level, these are classified as direct indirect monitoring. monitoring can be implemented external or sensors. Internal provide advantages with respect reliability, completeness, timeliness volume data, addition efficiency resistance against attacks. an architecture called ESP framework building systems based on We describe detail prototype embedded detectors mechanism localized reduction. show that it is possible build both specific (specialized certain intrusion) generic (able detect different types intrusions) detectors. Furthermore, we information about places most effective detecting Finally, performance testing impact have system. Detection capability significant percentage new