Abstraction-based misuse detection: high-level specifications and adaptable strategies

摘要: A typical misuse detection system contains: (1) a language for describing known techniques (called signatures) used by attackers to penetrate the target system, and (2) monitoring programs detecting presence of an attack based on given signatures. In most systems appearing in literature, however, description misuses is often terms low level (i.e. audit records system), that either has limited expressiveness or difficult use. Moreover algorithms are fixed do not adapt changing operating environment objectives site security officer. To overcome these limitations, paper defines high abstract signatures (MuSigs). Due use concepts, MuSig can represent simple form yet with expressiveness. The also introduces set directives provided designer support concepts. then discusses ways translate MuSigs into program help directives. adaptability obtained ability officer add delete change behavior program.