From Monitoring Templates to Security Monitoring and Threat Detection

Abstract. This paper presents our pattern-based approach to run-time requirements monitoring and threat detection being developed as part of an approach to build frameworks supporting the construction of secure and dependable systems for ambient intelligence. Our patterns infra-structure is based on templates. From templates we generate Event-Calculus formulas expressing security requirements to monitor at run-time. From these theories we generate attack signatures, describing threats or possible attacks to the system. At run-time, we evaluate the likelihood of threats from run-time observations using a probabilistic model based on Bayesian networks. Keywords Security, patterns, intrusion-detection, run-time monitoring, Event-Calculus.

• Type: Conference
• Year: 2008
• Where: SECURWARE
• Authors: Nuno Amálio, George Spanoudakis
• Keywords: Information Management, Run-time, Run-time Observations, Run-time Requirements, SECURWARE 2008