On the use of context in network intrusion detection systems

摘要: This thesis examines frameworks and mechanisms for building network intrusion detection systems. These systems perform a variety of complex analysis in order to enforce security policies, such enforcement requires contextual information from several sources. In this thesis, we examine three sources context. First, propose semi-automatic that can be used understand how application traffic manifests the network; are necessary incorporate semantics into policy enforcement. Second, analyze effectiveness exchange amongst multiple sites containing fast spreading worm. Third, framework helps system gain access encryped is typically decipherable only by end-host, while at same time, respecting confidentiality constraints on sensitive content embedded traffic.