A Context-Based Analysis of Intrusion Detection for Policy Violation

Existing intrusion detection systems (IDS) operate independently from security policy enforcement mechanism. In current IDS the functionality has been restricted to detecting only anomaly in system behavior and system misuse. In order to assist system administrators in restoring and strengthening system security after an intrusion is detected this paper proposes a method that will link the security violation to a non-empty subset of the policy base. A multiagent system is proposed to automate the intrusion detection and analysis.

• Type: Conference
• Year: 2007
• Where: CIS
• Authors: Kaiyu Wan, Vasu S. Alagar, Zongyuan Yang
• Keywords: CIS 2007, Intrusion Detection, Intrusion Detection Systems, Security Policy Enforcement