Sciweavers

Share
ACSAC
2000
IEEE

A Network Audit System for Host-based Intrusion Detection (NASHID) in Linux

11 years 9 months ago
A Network Audit System for Host-based Intrusion Detection (NASHID) in Linux
Recent work has shown that conventional operating system audit trails are insufficient to detect low-level network attacks. Because audit trails are typically based upon system calls or application sources, operations in the network protocol stack go unaudited. Earlier work has determined the audit data needed to detect low-level network attacks. In this paper we describe an implementation of an audit system which collects this data and analyze the issues that guided the implementation. Finally, we report the performance impact on the system and the rate of audit data accumulation in a test network.
Thomas E. Daniels, Eugene H. Spafford
Added 30 Jul 2010
Updated 30 Jul 2010
Type Conference
Year 2000
Where ACSAC
Authors Thomas E. Daniels, Eugene H. Spafford
Comments (0)
books