An Intrusion Detection Model Based Upon Intrusion Detection Markup Language (IDML)

林耀聰(Yao-Tsung Lin) ； 曾憲雄(Shian-Shyong Tseng) ； 林順傑(Shun-Chieh Lin)

《Journal of Information Science and Engineering》 17卷6期 (2001/11) Pp. 899-919

https://doi.org/10.6688/JISE.2001.17.6.2

並列摘要

Due to the rapid growth of networked computer resources and the increasing importance of related applications, intrusions which threaten the infrastructure of these applications have are critical problems. In recent years, several intrusion detection systems designed to identify and detect possible intrusion behaviors. In this work, an intrusion detection model is proposed to for building an intrusion detection system which can solve problems involved in building an intrusion detection systems, including pattern representation, computability, performance, extendibility and maintenance problems. In this model, IDML is first designed to express intrusion patterns, and these patterns are transformed into intrusion pattern state machines. Once the intrusion pattern state machines are obtained, the corresponding intrusion detection mechanism that can use these state machines to detect intrusions is designed. To evaluate the performance of our model, an IDML-based intrusion detection experimental system based upon this architecture has been implemented.

並列關鍵字

intrusion detection ； intrusion pattern ； IDML ； XML ； finite state machine