A Building Block Approach to Intrusion Detection

摘要: This paper details the design and implementation of a host-based intrusion detection system (Hewlett-Packard’s Praesidium IDS/9000) specialized kernel data source which supplies customized to IDS. Instead common attack-signature matching used in most other systems, IDS/9000 performs real-time monitoring looking for misuse actions that are indicative either attack or policy violations. These called building blocks. As part implementation, new was developed specifically aid detection. We describe desired characteristics an Intrusion Detection Data Source (IDDS) is provided separately from normal C2 audit subsystem. auditing subsystem provides records tailored needs system. Performance measurements provided, we also discuss some alternative uses were discovered during testing phase.