Sciweavers

Share
ISW
2004
Springer

A Model for the Semantics of Attack Signatures in Misuse Detection Systems

10 years 1 months ago
A Model for the Semantics of Attack Signatures in Misuse Detection Systems
Misuse Detection systems identify evidence of attacks by searching for patterns of known attacks (signatures). A main problem in this context is the modeling and specification of attack signatures. A couple of languages are proposed in the literature, which differ in the aspects of signatures that can be described. Some aspects that can be specified in one language cannot be expressed in another. In the area of Active Databases the specification of triggers constitutes a similar problem domain. Zimmer et al [9] have developed a Meta-Model for the semantics of complex events in Active Database systems. In this paper we discuss differences between active database triggers and attack signatures and adapt the Meta-Model to the domain of attack signatures. We present the adapted model, which systematically enumerates the different aspects that characterize attack signatures. The aspects are discussed in detail and their meaning is demonstrated using examples. The model for the semantics of ...
Michael Meier
Added 02 Jul 2010
Updated 02 Jul 2010
Type Conference
Year 2004
Where ISW
Authors Michael Meier
Comments (0)
books