An intrusion-detection model

DMCA

An intrusion-detection model (1987)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Dorothy E. Denning

Venue:	IEEE TRANSACTIONS ON SOFTWARE ENGINEERING
Citations:	630 - 0 self

BibTeX

@ARTICLE{Denning87anintrusion-detection,
    author = {Dorothy E. Denning},
    title = {An intrusion-detection model},
    journal = {IEEE TRANSACTIONS ON SOFTWARE ENGINEERING},
    year = {1987},
    volume = {13},
    number = {2},
    pages = {222--232}
}

OpenURL

Abstract

A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.

Keyphrases

intrusion-detection model audit record particular system application environment general-purpose intrusion-detection expert system statistical model abnormal pattern computer abuse anomalous behavior security violation system usage real-time intrusion-detection expert system system vulnerability

DMCA