Detecting computer and network misuse through the production-based expert system toolset (P-BEST)

摘要: The paper describes an expert system development toolset called the Production-Based Expert System Toolset (P-BEST) and how it is employed in of a modern generic signature analysis engine for computer network misuse detection. For more than decade, earlier versions P-BEST have been used intrusion detection research some most well known systems, but this first time principles language are described to wide audience. We present rule sets detecting subversion methods against which there few defenses-specifically, SYN flooding buffer overruns-and provide performance measurements. Together, these examples measurements indicate that based systems suited real contemporary computing environments. In addition, simplicity its close integration with C programming makes easy use while still being very powerful flexible.