Download A Real-Time Intrusion-Detection Expert System

Chapter I
Introduction
Existing security mechanisms protect computers and networks from unauthorized use
through access controls, such as passwords. However, if these access controls ‘are compromised or can be bypassed, an abuser may gain unauthorized access and thus can cause
great damage and disruption to system operation.
Although a computer system’s primary defense is its access controls, it is clear from
numerous newspaper accounts of break-ins, viruses, and computerized thefts that we
cannot rely on access control mechanisms in every case to safeguard against a penetration.
or insider attack. Even the most secure systems are vulnerable to abuse by insiders who
misuse their privileges, and audit trails may be the only means of detecting authorized
but abusive user activity.
Other modes of protection can be devised, however. An intruder is likely to exhibit
a behavior pattern that differs markedly from that of a legitimate user. An intruder
masquerading as a legitimate user can be detected through observation of this statistically
unusual behavior. This idea is the basis for enhancing system security by monitoring
system activity and detecting atypical behavior. Such a monitoring system will be capable
of detecting intrusions that could not be detected by any other means, for example,
intrusions that exploit unknown vulnerabilities. In addition, any computer system or
network has known vulnerabilities that can be exploited by an intruder. However, it is
more efficient to detect intrusions that exploit these known vulnerabilities through the
use of explicit expert-system rules than through statistical anomaly detection.
While many computer systems collect audit data, most do not have any capability for
automated analysis of that data. Moreover, those systems that do collect audit data
generally collect large volumes of data that are not necessarily security relevant. Thus,
for security analysis, a security officer (SO) must wade through stacks of printed output
of audit data. Besides the pure tedium of this task, the sheer volume of the data makes
it impossible for the security officer to detect suspicious activity that does not conform
1