IDEA

A new intrusion detection data source

William Mahoney, William Sousan

Research output: Contribution to journalArticle

Abstract

In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user's activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.

Original languageEnglish (US)
Pages (from-to)17-24
Number of pages8
JournalInternational Journal of Security and its Applications
Volume2
Issue number3
StatePublished - Dec 1 2008

Fingerprint

Intrusion detection
Computer systems
Monitoring

ASJC Scopus subject areas

  • Computer Science(all)

Cite this

IDEA : A new intrusion detection data source. / Mahoney, William; Sousan, William.

In: International Journal of Security and its Applications, Vol. 2, No. 3, 01.12.2008, p. 17-24.

Research output: Contribution to journalArticle

@article{2d677f33f02246cc96c1a57762de2893,
title = "IDEA: A new intrusion detection data source",
abstract = "In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user's activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.",
author = "William Mahoney and William Sousan",
year = "2008",
month = "12",
day = "1",
language = "English (US)",
volume = "2",
pages = "17--24",
journal = "International Journal of Security and its Applications",
issn = "1738-9976",
publisher = "Science and Engineering Research Support Society",
number = "3",

}

TY - JOUR

T1 - IDEA

T2 - A new intrusion detection data source

AU - Mahoney, William

AU - Sousan, William

PY - 2008/12/1

Y1 - 2008/12/1

N2 - In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user's activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.

AB - In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user's activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.

UR - http://www.scopus.com/inward/record.url?scp=84858229227&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84858229227&partnerID=8YFLogxK

M3 - Article

VL - 2

SP - 17

EP - 24

JO - International Journal of Security and its Applications

JF - International Journal of Security and its Applications

SN - 1738-9976

IS - 3

ER -