We recommend Intrusion Detection as prerequisite reading for this technology description.
Due to the voluminous, detailed nature of system audit data - some of which
may have little if any meaning to a human reviewer - and the difficulty of
discriminating between normal and intrusive behavior, one approach taken by
developers of intrusion detection systems is to use expert systems technology
to analyze automatically audit trail data for intrusion attempts
[Lunt 93]. These security systems, known as rule-based intrusion detection (RBID)
systems, can be used to analyze system audit trails for pending or completed
computer security violations. This emerging technology seeks to increase the
availability of computer systems by automating the detection and elimination of intrusions.
Rule-based intrusion detection (RBID) is predicated on the assumption that
intrusion attempts can be characterized by sequences of user activities that
lead to compromised system states. RBID systems are characterized by their
expert system properties that fire rules1 when audit records or system status
information begin to indicate illegal activity
[Ilgun 93]. These predefined rules typically look for high-level state change patterns observed in the audit data compared to predefined penetration state change scenarios. If an RBID expert system infers that a penetration is in process or has occurred, it will alert the computer system security officers and provide them with both a justification for the alert and the user identification of the suspected intruder.
There are two major approaches to rule-based intrusion detection:
- State-based. In this approach, the rule base is codified using
the terminology found in the audit trails. Intrusion attempts are defined as
sequences of system state- as defined by audit trail information- leading from
an initial, limited access state to a final compromised state
[Ilgun 93].
- Model-based. In this approach, known intrusion attempts are modeled as sequences of user behavior; these behaviors may then be modeled, for example, as events in an audit trail. Note, however, that the intrusion detection system itself is responsible for determining how an identified user behavior may manifest itself in an audit trail. This approach has many benefits, including the following:
- More data can be processed, because the technology allows you to narrow the focus of the data selectively.
- More intuitive explanations of intrusion attempts are possible.
- The system can predict the intruder's next action.
|
[Bell 76]
|
Bell, D. E. & LaPadula, L. J. Secure Computer System: Unified
Exposition and Multics Interpretation Rev. 1 (MTR-2997). Bedford, MA:
MITRE Corporation, 1976.
|
|
[Denning 87]
|
Denning, Dorothy E., et al. "Views for Multilevel Database Security." IEEE
Transactions on Software Engineering SE-13, 2 (February 1987):
129-140.
|
|
[CSC 83]
|
Computer Security Center. Department of Defense Trusted Computer System
Evaluation Criteria. Fort George G. Meade, MD: DoD Computer Security
Center, 1983.
|
|
[Ilgun 93]
|
Ilgun, Koral. "USTAT: A Real-time Intrusion Detection System for UNIX,"
16-28. Proceedings of the 1993 Computer Society Symposium on Research in
Security and Privacy. Oakland, California, May 24-26, 1993. Los Alamitos,
CA: IEEE Computer Society Press, 1993.
|
|
[Kemmerer 94]
|
Kemmerer, Richard A. "Computer Security," 1153-1164. Encyclopedia of
Software Engineering. New York, NY: John Wiley and Sons, 1994.
|
|
[Lunt 93]
|
Lunt, Teresa F. "A Survey of Intrusion Detection Techniques." Computers
and Security 12, 4 (June 1993): 405-418.
|
|
[Mukherjee 94]
|
Mukherjee, Biswanath, L.; Heberlein, Todd; & Levitt, Karl N. "Network
Intrusion Detection." IEEE Network 8, 3 (May/June 1994): 26-41.
|
|
[Sundaram 96]
|
Sundaram, Aurobindo. An Introduction to Intrusion Detection
[online]. Available WWW
<URL:
http://www.acm.org/crossroads/xrds2-4/xrds2-4.html> (1996).
|
|
[Tener 86]
|
Tener, W. T. "Discovery: An Expert System in the Commercial Data Security
Environment." Computer Security Journal 6, 1 (Summer 1990):
45.
|
|
[Vaccarro 89]
|
Vaccarro, H. S. & Liepins, G. E. "Detection of Anomalous Computer Session
Activity," 208-209. Proceedings of the IEEE Symposium on Research in
Security and Privacy. Oakland, California, May 1-3, 1989. Washington, DC:
IEEE Computer Society Press, 1989.
|
|
[Ware 79]
|
Ware, W. H. Security Controls for Computer Systems: Report of Defense
Science Board, Task Force on Computer Security. Santa Monica, CA: The
Rand Corporation, 1979.
|
1
In an expert system, knowledge about a problem domain is represented by a set
of rules. These rules consist
of two parts:
- The antecedent, which defines when the rule should be applied. An expert
system will use pattern matching
techniques to determine when the observed data matches or satisfies the
antecedent of a rule.
- The consequent, which defines the action(s) that should be taken if its
antecedent is satisfied.
A rule is said to be "fired" when the action(s) defined in its consequent are
executed. For RBID systems, rule
antecedents will typically be defined in terms of audit trail data, while rule
consequents may be used to
increase or decrease the level of monitoring of various entities, or they may
be used to notify system
administration personnel about significant changes in system state.
