IDEA: A new intrusion detection data source

William Mahoney, William Sousan

Research output: Contribution to journalArticle

Abstract

In the context of computer systems, an intrusion is generally considered to be a harmful endeavor to prevent others from legitimate use of that system, to obtain data which is not normally available to the intruder, or to plant data or disrupt data already existent on the machines. Traditionally intrusion detection has relied on two data sources: various log files which record user's activity, and network traffic which contains potential threats. This research presents a system which we call IDEA; the Intrusion DEtection Automata system. We utilize a third source of data for intrusion detection in the form of an instrumented process. Open source software is recompiled using a modified compiler we have created, and the resulting executable program generates the data as it runs. An external monitoring facility then checks the behavior of the program against known good execution paths. These paths are specified either using a domain specific language and hand-written rules, or by running the software in a learning mode and capturing the normal behavior for later comparison.

Original languageEnglish (US)
Pages (from-to)17-24
Number of pages8
JournalInternational Journal of Security and its Applications
Volume2
Issue number3
StatePublished - 2008

ASJC Scopus subject areas

  • Computer Science(all)

Fingerprint Dive into the research topics of 'IDEA: A new intrusion detection data source'. Together they form a unique fingerprint.

Cite this