Classification And Detection Of Computer Intrusions

Some computer security breaches cannot be prevented using access and information flow control techniques. These breaches may be a consequence of system software bugs, hardware or software failures, incorrect system administration procedures, or failure of the system authentication module. Intrusion detection techniques can have a significant role in detection of computer abuse in such cases. This dissertation describes a pattern matching approach to represent and detecting intrusions, a hitherto untried approach in this field. We have classified intrusions on the basis of structural interrelationships amon observable system events. The classification formalizes detection of specific exploitations by examining their manifestations in the system eevnt trace. Thus, we can talk about intrusion signatures belonging to particual catagories in the classification, instead of vvulnerabilities that result in intrusions. ..