System Health and Intrusion Monitoring Using a Hierarchy of Constraints

摘要: This paper presents a new approach to run-time security monitoring that can detect system abnormalities including attacks, faults, or operational errors. The approach, System Health and Intrusion Monitoring (SHIM), employs hierarchy of constraints describe correct operation at various levels abstraction. capture static behavior, dynamic time-critical behavior system. A in execution will be monitored for violation the constraints, which may indicate potential problems SHIM is based on specification-based intrusion detection, but it attempts provide systematic framework developing specifications/ constraints. does not directly intrusive actions an attack, their manifestations as violations In this paper, we constraint model methodology addition, present preliminary results developed host programs network protocols. By bounding components different abstraction, has high chance detecting types attacks variants.