orchids on the value of rigor in intrusion detection
play

OrchIDS: on the value of rigor in intrusion detection Jean - PowerPoint PPT Presentation

Feb 16, 2023 •147 likes •1.93k views

OrchIDS: on the value of rigor in intrusion detection Jean Goubault-Larrecq CPS, Grenoble, July 08 2014 vendredi 11 juillet 14 Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and

  1. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) Orchids threads: (none) vendredi 11 juillet 14

  2. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=57, euid=500, tgt=58 vendredi 11 juillet 14

  3. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  4. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  5. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  6. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  7. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  8. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  9. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  10. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  11. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  12. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  13. Related work • P-Best [Lindqvist-Porras 1999] • Statl [Eckmann-Vigna-Kemmerer 2000] • Chronicles [e.g., Morin-Debar 2003] • Lambda [Cuppens-Miege 2002] • Sutekh [Pouzol-Ducassé 2002] • Blare [George-VietTriemTong-Mé 2009] • RV-Monitor [Rosu et al. 2008, 09, 12, 14] • ... and probably many others vendredi 11 juillet 14

  14. Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and algorithms 4. NetEntropy : detecting subverted cryptographic flows 5.Conclusion vendredi 11 juillet 14

  15. Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and algorithms 4. NetEntropy : detecting subverted cryptographic flows 5.Conclusion vendredi 11 juillet 14

  16. Semantics, and detection algorithms • Semantics: what should Orchids detect? • Algorithm: how should I detect it? (This is what I showed you.) • Semantics dictates the algorithm. • ... somehow opposite to the average coding attitude • we like to think algorithmically • we are eager to code http://www.sadgrin.com/wp-content/uploads/2013/03/geek-300x300.jpg vendredi 11 juillet 14

  17. Semantics, and detection algorithms • Semantics: what should Orchids detect? • Algorithm: how should I detect it? (This is what I showed you.) • Semantics dictates the algorithm. • ... somehow opposite to the average coding attitude • we like to think algorithmically • we are eager to code http://www.sadgrin.com/wp-content/uploads/2013/03/geek-300x300.jpg vendredi 11 juillet 14

  18. Semantics, 1 • ORCHIDS looks for subsequences of events (« runs ») A A A ptrace ( ATTACH , ...) B ptrace ( DETACH , ...) ptrace ( GETREGS , ...) B B A B A exec (...) B ptrace ( SYSCALL , ...) A ptrace ( POKETEXT , ...) A ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 � (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) vendredi 11 juillet 14

  19. Semantics, 1 • ORCHIDS looks for subsequences of events (« runs ») A A A ptrace ( ATTACH , ...) B ptrace ( DETACH , ...) ptrace ( GETREGS , ...) B B A B A exec (...) B ptrace ( SYSCALL , ...) A ptrace ( POKETEXT , ...) A ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 � (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) vendredi 11 juillet 14

  20. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Here is one: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  21. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Another one: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  22. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Yet another: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  23. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time A A 1 2 3 vendredi 11 juillet 14

  24. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an (Here, .) iff 1 2 A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time starting A run is minimal iff is minimal (w. fixed) and ... ws i 1 . < i k iff A A 1 2 3 vendredi 11 juillet 14

  25. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an Another example: iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 2 3 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  26. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices starting ws i 1 < i 2 < . . . < i k an This one, stops at minimal (=8): iff . < i k iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 4 5 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  27. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an And this one too: iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 4 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  28. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an And again this one! iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  29. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  30. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  31. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  32. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 1 8 vendredi 11 juillet 14

  33. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 1 8 vendredi 11 juillet 14

  34. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 4 5 6 7 8 1 8 vendredi 11 juillet 14

  35. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  36. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  37. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 5 8 1 2 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  38. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 7 8 1 2 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  39. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  40. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  41. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  42. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  43. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  44. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  45. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  46. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  47. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  48. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 5 6 7 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  49. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 5 6 7 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  50. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  51. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  52. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  53. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  54. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 The largest 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  55. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 The largest The smallest 1 4 5 6 7 8 1 4 5 8 1 4 7 8 ... and most informative 1 6 7 8 1 8 vendredi 11 juillet 14

  56. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  57. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  58. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ching subsequences starting ws i 1 . < i k D C the sequence ws i 1 < i 2 < . . . < i k an iff is lexicographically minimal iff A B 1 2 4 vendredi 11 juillet 14

Recommend

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be bad Anomaly intrusion detection Try to detect deviations from normal behavior Specification intrusion detection Try to detect

627 views • 15 slides
Intrusion Detection Principles Basics Models of Intrusion Detection

Intrusion Detection Principles Basics Models of Intrusion Detection

Intrusion Detection Principles Basics Models of Intrusion Detection Architecture of an IDS Architecture of an IDS Organization Incident Response Slide #22-1 FEARLESS engineering Principles of Intrusion Detection

744 views • 40 slides
Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection

Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection

Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection Architecture of an IDS Organization Incident Response June 2, 2005 ECS 235, Computer and Information Slide #1 Security Principles of

1.38k views • 104 slides
Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion

Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion

Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion Detection Systems Tripwire Snort 2 IDS (Definition) Intrusion Detection is the process of monitoring the events occurring in a computer

571 views • 30 slides
Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection

Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection

Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection solution is impossible Good behavior on one system is bad behavior on another Behaviors change and new vulnerabilities are discovered

700 views • 23 slides
Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239 systems Computer Software Some sample intrusion detection March 9, 2005 systems Lecture 15 Lecture 15 Page 1 Page 2 CS 239, Winter 2005

602 views • 12 slides
Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236 systems Computer Software Some sample intrusion detection March 12, 2007 systems Lecture 14 Lecture 14 Page 1 Page 2 CS 236, Winter 2007

537 views • 10 slides
Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative

Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative

Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative submittal instructions submittal instructions answer the lab assignments questions in written report form, as a text, pdf, or Word document

504 views • 21 slides
Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing

Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing

Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy Chapter 13 Using Rules and Thresholds for

297 views • 7 slides
Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter

Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter

Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter Reiher Lecture 11 Page 1 CS 236 Online Outline Introduction Characteristics of intrusion detection systems Some sample intrusion detection

143 views • 12 slides
Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion

Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion

Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion Detection Systems Detect malicious Raise alarms activities/attacks Alert administrators Hacking/ unauthorized access Trigger defense

217 views • 21 slides
Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu

Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu

Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu BERKE1337 March 3, 2016 Outline 1. Intrusion Detection 101 2. Bro 3. Network Forensics Exercises 1 / 29 Detection vs. Blocking Intrusion

432 views • 32 slides
Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International

Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International

Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International Conference on Computing in High Energy and Nuclear Physics Outline: Introduction Threat model Intrusion prevention Intrusion detection

420 views • 16 slides
Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

ITS335 Intrusion Detection Intruders Intrusion Detection Host-Based Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots Summary Sirindhorn International Institute of Technology Thammasat University

585 views • 30 slides
Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald

Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald

Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald Tripp www.kent.ac.uk Network intrusion detection Network intrusion detection systems are provided to detect the presence of various security

260 views • 12 slides
Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What

Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What

Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What this talk is about? Automotive intrusion detection Automotive cyber-security architecture From the highest viewpoint J 3 Outline Quick

926 views • 63 slides
Intrusion Detection Computer Security Peter Reiher November 18, 2014 Lecture 11 Page 1 CS

Intrusion Detection Computer Security Peter Reiher November 18, 2014 Lecture 11 Page 1 CS

Intrusion Detection Computer Security Peter Reiher November 18, 2014 Lecture 11 Page 1 CS 136, Fall 2014 Outline Introduction Characteristics of intrusion detection systems Some sample intrusion detection systems Lecture 11

737 views • 63 slides
Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik Sengupta, Ankur Chowdhary, Subbarao Kambhampati Dijiang Huang SNAC Secure Networking and Yochan AI Lab Computing Lab Intrusion Detection Systems?

681 views • 38 slides
Intrusion Detection W enke Lee Com puter Science Departm ent Colum bia University Intrusion and

Intrusion Detection W enke Lee Com puter Science Departm ent Colum bia University Intrusion and

Intrusion Detection W enke Lee Com puter Science Departm ent Colum bia University Intrusion and Computer Security Com puter security: confidentiality, integrity, and availability Intrusion: actions to com prom ise security W hy

1.09k views • 63 slides
Authorization: Intrusion Detection Prof. Tom Austin San Jos State University Prevention vs.

Authorization: Intrusion Detection Prof. Tom Austin San Jos State University Prevention vs.

CS 166: Information Security Authorization: Intrusion Detection Prof. Tom Austin San Jos State University Prevention vs. Detection Most systems we've discussed focus on keeping the bad guys out. Intrusion prevention is a traditional

479 views • 34 slides
Intrusion Detection Using Monitor Information Fusion Student: Atul Bohara P.I.: William H.

Intrusion Detection Using Monitor Information Fusion Student: Atul Bohara P.I.: William H.

Intrusion Detection Using Monitor Information Fusion Student: Atul Bohara P.I.: William H. Sanders Previous Work [1] Intrusion detection by combining and clustering diverse monitor data System Logs Firewall Logs Feature extraction Cluster

527 views • 49 slides
Perimeter Intrusion Detection Mikro Tek Detection Technologies Ltd | +44 (0) 1773 744750 |

Perimeter Intrusion Detection Mikro Tek Detection Technologies Ltd | +44 (0) 1773 744750 |

Perimeter Intrusion Detection Mikro Tek Detection Technologies Ltd | +44 (0) 1773 744750 | info@detection-technologies.com | www.detection-technologies.com Mikro Tek Key Advantages One analyzer - up to 300m detection range! A single Mikro Tek

874 views • 6 slides
IPv6 Intrusion Detection Research Project Carsten Rossenhvel, EANTC AG Sven Schindler,

IPv6 Intrusion Detection Research Project Carsten Rossenhvel, EANTC AG Sven Schindler,

IPv6 Intrusion Detection Research Project Carsten Rossenhvel, EANTC AG Sven Schindler, Universitt Potsdam Co-Financed By: Project Goals Independently assess the true, current risks of IPv6 attacks Develop intrusion detection tools for

447 views • 17 slides
Constrained approximate search in misuse-based intrusion detection Ambika Shrestha Chitrakar

Constrained approximate search in misuse-based intrusion detection Ambika Shrestha Chitrakar

Constrained approximate search in misuse-based intrusion detection Ambika Shrestha Chitrakar Supervisor: Prof. Slobodan Petrovic FINSE 10th of may 2017 Contents Introduction Snort: a misuse-based intrusion detection Problem

247 views • 14 slides

More recommend