An improved reference flow control model for policy-based intrusion detection (2003)
| Venue: | IN PROCEEDINGS OF THE EUROPEAN SYMPOSIUM ON RESEARCH IN COMPUTER SECURITY (ESORICS 2003) |
| Citations: | 6 - 1 self |
BibTeX
@INPROCEEDINGS{Zimmermann03animproved,
author = {Jacob Zimmermann and Ludovic Mé and Christophe Bidan},
title = {An improved reference flow control model for policy-based intrusion detection},
booktitle = {IN PROCEEDINGS OF THE EUROPEAN SYMPOSIUM ON RESEARCH IN COMPUTER SECURITY (ESORICS 2003)},
year = {2003},
pages = {291--308},
publisher = {}
}
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract. In this paper, we describe a novel approach to policy-based intrusion detection. The model we propose checks legality of information flows between objects in the system, according to an existing security policy specification. These flows are generated by executed system operations. Illegal flows, i.e., not authorized by the security policy, are signaled and considered as intrusion symptoms. This model is able to detect a large class of attacks, referred to as “attacks by delegation ” in this paper. Since the approach focuses really on attack effects instead of attack scenarii, unknown attacks by delegation can be detected. Keywords: Policy-based intrusion detection, information flow control, access control 1
