Towards a taxonomy of intrusion-detection systems

Intrusion-detection systems aim at detecting attacks against computer systems and networks, or in general against information systems Indeed, it is difficult to provide provably secure information systems and to maintain them in such a secure state during their lifetime and utilization Sometimes, legacy or operational constraints do not even allow the definition of a fully secure information system Therefore, intrusion- detection systems have the task of monitoring the usage of such systems to detect apparition of insecure states They detect attempts and active misuse, either by legitimate users of the information systems or by external parties, to abuse their privileges or exploit security vulnerabilities In a previous paper [Computer networks 31, 805–822 (1999)], we introduced a taxonomy of intrusion- detection systems that highlights the various aspects of this area This paper extends the taxonomy beyond real- time intrusion detection to include additional aspects of security monitoring, such as vulnerability assessment

A revised taxonomy for intrusion-detection systems

This chapter provides the overview of the state of the art in intrusion detection research. Intrusion detection systems are software and/or hardware components that monitor computer systems and analyze events occurring in them for signs of intrusions. Due to widespread diversity and complexity of computer infrastructures, it is difficult to provide a completely secure computer system. Therefore, there are numerous security systems and intrusion detection systems that address different aspects of computer security. This chapter first provides taxonomy of computer intrusions, along with brief descriptions of major computer attack categories. Second, a common architecture of intrusion detection systems and their basic characteristics are presented. Third, taxonomy of intrusion detection systems based on five criteria (information source, analysis strategy, time aspects, architecture, response) is given. Finally, intrusion detection systems are classified according to each of these categories and the most representative research prototypes are briefly described.

/pdf/intrusion-detection-a-survey-37eu7ihs6p.pdf

Intrusion Detection: A Survey

The ability to detect intruders in computer systems increases in importance as computers are increasingly integrated into the systems that we rely on for the correct functioning of society. This paper reviews the history of research in intrusion detection as performed in software in the context of operating systems for a single computer, a distributed system, or a network of computers. There are two basic approaches: anomaly detection and misuse detection. Both have been practiced since the 1980s. Both have naturally scaled to use in distributed systems and networks.

Computer System Intrusion Detection: A Survey

With the progression of computer networks extending boundaries and joining distant locations, wireless sensor networks (WSN) emerge as the new frontier in developing opportunities to collect and process data from remote locations. Like IEEE 802.3 wired and IEEE 802.11 wireless networks, remote wireless sensor networks are vulnerable to malicious attacks. While wired and infrastructure-based wireless networks have mature intrusion detection systems and sophisticated firewalls to block these attacks, wireless sensor networks have only primitive defenses. WSNs rely on hardware simplicity to make sensor field deployments both affordable and long-lasting without any maintenance support. Energy-constrained sensor networks periodically place nodes to sleep in order to extend the network lifetime. Denying sleep effectively attacks each sensor node's critical energy resources and rapidly drains the network's lifetime. This paper analyzes the energy resource vulnerabilities of wireless sensor networks, models the network lifetimes of leading WSN medium access control (MAC) protocols, and proposes a new MAC protocol which mitigates many of the effects of denial of sleep attacks.

Cannady

Papers

A Comparative Analysis of Current Intrusion Detection Technologies