/Users/andrea/_magisterarbeit/korpus/clean/testkorpus/1/file5.html NN ----------------------------------------- : An DT Introduction NN to TO Intrusion NN Detection NN by IN Aurobindo NP Sundaram NP Introduction NN In IN the DT last JJ three CD years NNS , , the DT networking NN revolution NN has VHZ finally RB come VVN of IN age NN . SENT More RBR than IN ever RB before RB , , we PP see VVP that IN the DT Internet NN is VBZ changing VVG computing VVG as IN we PP know VVP it PP . SENT The DT possibilities NNS and CC opportunities NNS are VBP limitless JJ . SENT unfortunately RB , , so RB too RB are VBP the DT risks NNS and CC chances NNS of IN malicious JJ intrusions NNS . SENT It PP is VBZ very RB important JJ that IN the DT security NN mechanisms NNS of IN a DT system NN are VBP designed VVN so RB as IN to TO prevent VV unauthorized JJ access NN to TO system NN resources NNS and CC data NNS . SENT However RB , , completely RB preventing VVG breaches NNS of IN security NN appear VVP , , at IN present JJ , , unrealistic JJ . SENT We PP can MD , , however RB , , try VVP to TO detect VV these DT intrusion NN attempts VVZ so RB that WDT action NN may MD be VB taken VVN to TO repair VV the DT damage NN later RBR . SENT This DT field NN of IN research NN is VBZ called VVN Intrusion NN Detection NN . SENT Anderson NP , , while IN introducing VVG the DT concept NN of IN intrusion NN detection NN in IN 1980 CD 1 CD , , defined VVN an DT intrusion NN attempt NN or CC a DT threat NN to TO be VB the DT potential JJ possibility NN of IN a DT deliberate JJ unauthorized JJ attempt NN to TO access NN information NN , , manipulate VV information NN , , or CC render VV a DT system NN unreliable JJ or CC unusable JJ . SENT Since IN then RB , , several JJ techniques NNS for IN detecting VVG intrusions NNS have VHP been VBN studied VVN . SENT This DT paper NN discusses VVZ why WRB intrusion NN detection NN systems NNS are VBP needed VVN , , the DT main JJ techniques NNS , , present JJ research NN in IN the DT field NN , , and CC possible JJ future JJ directions NNS of IN research NN . SENT The DT need NN for IN Intrusion NN Detection NN Systems NP A NP computer NN system NN should MD provide VV confidentiality NN , , integrity NN and CC assurance NN against IN denial NN of IN service NN . SENT However RB , , due JJ to TO increased JJ connectivity NN especially RB on IN the DT Internet NN , , and CC the DT vast JJ spectrum NN of IN financial JJ possibilities NNS that WDT are VBP opening VVG up RP , , more JJR and CC more JJR systems NNS are VBP subject JJ to TO attack VV by IN intruders NNS . SENT These DT subversion NN attempts NNS try VVP to TO exploit VV flaws NNS in IN the DT operating VVG system NN as IN well RB as RB in IN application NN programs NNS and CC have VHP resulted VVN in IN spectacular JJ incidents NNS like IN the DT Internet NP Worm NP incident NN of IN 1988 CD 12 CD . SENT There EX are VBP two CD ways NNS to TO handle VV subversion NN attempts NNS . SENT One CD way NN is VBZ to TO prevent VV subversion NN itself PP by IN building VVG a DT completely RB secure JJ system NN . SENT We PP could MD , , for IN example NN , , require VVP all DT users NNS to TO identify VV and CC authenticate VV themselves PP . SENT we PP could MD protect VV data NNS by IN various JJ cryptographic JJ methods NNS and CC very RB tight JJ access NN control NN mechanisms NNS . SENT However RB this DT is VBZ not RB really RB feasible JJ because IN . SENT In IN practice NN , , it PP is VBZ not RB possible JJ to TO build VV a DT completely RB secure JJ system NN . SENT Miller NP 10 NP gives VVZ a DT compelling JJ report NN on IN bugs NNS in IN popular JJ programs NNS and CC operating VVG systems NNS that WDT seems VVZ to TO indicate VV that IN a DT bug NN free JJ software NN is VBZ still RB a DT dream NN and CC b LS no DT one NN seems VVZ to TO want VV to TO make VV the DT effort NN to TO try VV to TO develop VV such JJ software NN . SENT Apart RB from IN the DT fact NN that IN we PP do VVP not RB seem VV to TO be VB getting VVG our PP$ money's NNS worth IN when WRB we PP buy VVP software NN , , there EX are VBP also RB security NN implications NNS when WRB our PP$ E NN mail NN software NN , , for IN example NN , , can MD be VB attacked VVN . SENT Designing VVG and CC implementing VVG a DT totally RB secure JJ system NN is VBZ thus RB an DT extremely RB difficult JJ task NN . SENT The DT vast JJ installed JJ base NN of IN systems NNS worldwide JJ guarantees NNS that IN any DT transition NN to TO a DT secure JJ system NN , , if IN it PP is VBZ ever RB developed VVN will MD be VB long JJ in IN coming VVG . SENT Cryptographic JJ methods NNS have VHP their PP$ own JJ problems NNS . SENT Passwords NNS can MD be VB cracked VVN , , users NNS can MD lose VV their PP$ passwords NNS , , and CC entire JJ crypto NN systems NNS can MD be VB broken VVN . SENT Even RB a DT truly RB secure JJ system NN is VBZ vulnerable JJ to TO abuse VV by IN insiders NNS who WP abuse VV their PP$ privileges NNS . SENT It PP has VHZ been VBN seen VVN that IN that IN the DT relationship NN between IN the DT level NN of IN access NN control NN and CC user NN efficiency NN is VBZ an DT inverse JJ one NN , , which WDT means VVZ that IN the DT stricter JJR the DT mechanisms NNS , , the DT lower JJR the DT efficiency NN becomes VVZ . SENT We PP thus RB see VVP that IN we PP are VBP stuck VVN with IN systems NNS that WDT have VHP vulnerabilities NNS for IN a DT while NN to TO come VV . SENT If IN there EX are VBP attacks NNS on IN a DT system NN , , we PP would MD like VV to TO detect VV them PP as RB soon RB as RB possible JJ preferably RB in IN real JJ time NN and CC take VV appropriate JJ action NN . SENT This DT is VBZ essentially RB what WP an DT Intrusion NN Detection NN System NP IDS NP does VVZ . SENT An DT IDS NP does VVZ not RB usually RB take VV preventive JJ measures NNS when WRB an DT attack NN is VBZ detected VVN . SENT it PP is VBZ a DT reactive JJ rather RB than IN pro JJ active JJ agent NN . SENT It PP plays VVZ the DT role NN of IN an DT informant NN rather RB than IN a DT police NN officer NN . SENT The DT most RBS popular JJ way NN to TO detect VV intrusions NNS has VHZ been VBN by IN using VVG the DT audit NN data NNS generated VVN by IN the DT operating NN system NN . SENT An DT audit NN trail NN is VBZ a DT record NN of IN activities NNS on IN a DT system NN that WDT are VBP logged VVN to TO a DT file NN in IN chronologically RB sorted VVN order NN . SENT Since IN almost RB all DT activities NNS are VBP logged VVN on IN a DT system NN , , it PP is VBZ possible JJ that IN a DT manual JJ inspection NN of IN these DT logs NNS would MD allow VV intrusions NNS to TO be VB detected VVN . SENT However RB , , the DT incredibly RB large JJ sizes NNS of IN audit NN data NNS generated VVN on IN the DT order NN of IN 100 CD Megabytes NNS a DT day NN make VV manual JJ analysis NN impossible JJ . SENT IDSs NN automate VV the DT drudgery NN of IN wading VVG through IN the DT audit NN data NN jungle NN . SENT Audit NN trails NNS are VBP particularly RB useful JJ because IN they PP can MD be VB used VVN to TO establish VV guilt NN of IN attackers NNS , , and CC they PP are VBP often RB the DT only JJ way NN to TO detect VV unauthorized JJ but CC subversive JJ user NN activity NN . SENT Many JJ times NNS , , even RB after IN an DT attack NN has VHZ occurred VVN , , it PP is VBZ important JJ to TO analyze VV the DT audit NN data NNS so RB that IN the DT extent NN of IN damage NN can MD be VB determined VVN , , the DT tracking NN down RB of IN the DT attackers NNS is VBZ facilitated VVN , , and CC steps NNS may MD be VB taken VVN to TO prevent VV such JJ attacks NNS in IN future NN . SENT An DT IDS NP can MD also RB be VB used VVN to TO analyze VV audit NN data NNS for IN such JJ insights NNS . SENT This DT makes VVZ IDSs NP valuable JJ as IN real JJ time NN as IN well RB as IN post NN mortem NN analysis NN tools NNS . SENT Spafford NP 13 CD reports NNS . SENT Information NN theft NN is VBZ up RB over IN 250 CD in IN the DT last JJ 5 CD years NNS . SENT 99 CD of IN all DT major JJ companies NNS report VVP at IN least JJS one CD major JJ incident NN . SENT Telecom NP and CC computer NN fraud NN totaled VVD 10 CD billion CD in IN the DT US NP alone RB . SENT It PP is VBZ thus RB more RBR important JJ than IN ever RB before RB that IN since IN it PP seems VVZ obvious JJ that IN we PP cannot NN prevent VV subversion NN , , we PP should MD at IN least JJS try VV to TO detect VV it PP and CC prevent VV similar JJ attacks NNS in IN future NN . SENT In IN the DT following VVG sections NNS , , we PP use VVP definitions NNS from IN the DT pioneering VVG work NN in IN intrusion NN detection NN 1 CD Risk NN . SENT Accidental JJ or CC unpredictable JJ exposure NN of IN information NN , , or CC violation NN of IN operations NNS integrity NN due JJ to TO the DT malfunction NN of IN hardware NN or CC incomplete JJ or CC incorrect JJ software NN design NN . SENT Vulnerability NN . SENT A DT known VVN or CC suspected VVN flaw NN in IN the DT hardware NN or CC software NN or CC operation NN of IN a DT system NN that WDT exposes VVZ the DT system NN to TO penetration NN or CC its PP$ information NN to TO accidental JJ disclosure NN . SENT Attack NN . SENT A DT specific JJ formulation NN or CC execution NN of IN a DT plan NN to TO carry VV out RP a DT threat NN . SENT Penetration NN . SENT A DT successful JJ attack NN the DT ability NN to TO obtain VV unauthorized JJ undetected JJ access NN to TO files NNS and CC programs NNS or CC the DT control NN state NN of IN a DT computer NN system NN . SENT Anderson NP also RB classified VVD intruders NNS into IN two CD types NNS , , the DT external JJ intruders NNS who WP are VBP unauthorized JJ users NNS of IN the DT machines NNS they PP attack VVP , , and CC internal JJ intruders NNS , , who WP have VHP permission NN to TO access VV the DT system NN , , but CC not RB some DT portions NNS of IN it PP . SENT He PP further RBR divided VVN internal JJ intruders NNS into IN intruders NNS who WP masquerade VV as IN another DT user NN , , those DT with IN legitimate JJ access NN to TO sensitive JJ data NNS , , and CC the DT most RBS dangerous JJ type NN , , the DT clandestine JJ intruders NNS who WP have VHP the DT power NN to TO turn VV off RP audit NN control NN for IN themselves PP . SENT Classification NN of IN Intrusion NN Detection NN Systems NP Intrusions NNS can MD be VB divided VVN into IN 6 CD main JJ types NNS 11 CD Attempted JJ break NN ins NNS , , which WDT are VBP detected VVN by IN atypical JJ behavior NN profiles NNS or CC violations NNS of IN security NN constraints NNS . SENT Masquerade NN attacks NNS , , which WDT are VBP detected VVN by IN atypical JJ behavior NN profiles NNS or CC violations NNS of IN security NN constraints NNS . SENT Penetration NN of IN the DT security NN control NN system NN , , which WDT are VBP detected VVN by IN monitoring VVG for IN specific JJ patterns NNS of IN activity NN . SENT Leakage NN , , which WDT is VBZ detected VVN by IN atypical JJ use NN of IN system NN resources NNS . SENT Denial NN of IN service NN , , which WDT is VBZ detected VVN by IN atypical JJ use NN of IN system NN resources NNS . SENT Malicious JJ use NN , , which WDT is VBZ detected VVN by IN atypical JJ behavior NN profiles NNS , , violations NNS of IN security NN constraints NNS , , or CC use NN of IN special JJ privileges NNS . SENT However RB , , we PP can MD divide VV the DT techniques NNS of IN intrusion NN detection NN into IN two CD main JJ types NNS . SENT Anomaly NN Detection NN . SENT Anomaly NN detection NN techniques NNS assume VVP that IN all DT intrusive JJ activities NNS are VBP necessarily RB anomalous JJ . SENT This DT means VVZ that IN if IN we PP could MD establish VV a DT normal JJ activity NN profile NN for IN a DT system NN , , we PP could MD , , in IN theory NN , , flag NN all DT system NN states NNS varying VVG from IN the DT established VVN profile NN by IN statistically RB significant JJ amounts NNS as IN intrusion NN attempts NNS . SENT However RB , , if IN we PP consider VVP that IN the DT set NN of IN intrusive JJ activities NNS only RB intersects VVZ the DT set NN of IN anomalous JJ activities NNS instead RB of IN being VBG exactly RB the DT same JJ , , we PP find VVP a DT couple NN of IN interesting JJ possibilities NNS . SENT 1 CD Anomalous JJ activities NNS that WDT are VBP not RB intrusive JJ are VBP flagged VVN as IN intrusive JJ . SENT 2 CD Intrusive JJ activities NNS that WDT are VBP not RB anomalous JJ result NN in IN false JJ negatives NNS events NNS are VBP not RB flagged VVN intrusive JJ , , though IN they PP actually RB are VBP . SENT This DT is VBZ a DT dangerous JJ problem NN , , and CC is VBZ far RB more RBR serious JJ than IN the DT problem NN of IN false JJ positives NNS . SENT The DT main JJ issues NNS in IN anomaly NN detection NN systems NNS thus RB become VVP the DT selection NN of IN threshold NN levels NNS so RB that IN neither CC of IN the DT above JJ 2 CD problems NNS is VBZ unreasonably RB magnified VVN , , and CC the DT selection NN of IN features NNS to TO monitor VV . SENT Anomaly NN detection NN systems NNS are VBP also RB computationally RB expensive JJ because IN of IN the DT overhead NN of IN keeping VVG track NN of IN , , and CC possibly RB updating VVG several JJ system NN profile NN metrics NNS . SENT Some DT systems NNS based VVN on IN this DT technique NN are VBP discussed VVN in IN Section NP 4 CD while IN a DT block NN diagram NN of IN a DT typical JJ anomaly NN detection NN system NN is VBZ shown VVN in IN Figure NP 1 CD . SENT Misuse NN Detection NN . SENT The DT concept NN behind IN misuse NN detection NN schemes NNS is VBZ that IN there EX are VBP ways NNS to TO represent VV attacks NNS in IN the DT form NN of IN a DT pattern NN or CC a DT signature NN so RB that IN even JJ variations NNS of IN the DT same JJ attack NN can MD be VB detected VVN . SENT This DT means VVZ that IN these DT systems NNS are VBP not RB unlike IN virus NN detection NN systems NNS they PP can MD detect VV many JJ or CC all DT known VVN attack NN patterns NNS , , but CC they PP are VBP of IN little JJ use NN for IN as RB yet RB unknown JJ attack NN methods NNS . SENT An DT interesting JJ point NN to TO note VV is VBZ that WDT anomaly NN detection NN systems NNS try VVP to TO detect VV the DT complement VV of IN bad JJ behavior NN . SENT Misuse NN detection NN systems NNS try VVP to TO recognize VV known VVN bad JJ behavior NN . SENT The DT main JJ issues NNS in IN misuse NN detection NN systems NNS are VBP how WRB to TO write VV a DT signature NN that WDT encompasses VVZ all DT possible JJ variations NNS of IN the DT pertinent JJ attack NN , , and CC how WRB to TO write VV signatures NNS that WDT do VVP not RB also RB match VV non JJ intrusive JJ activity NN . SENT Several JJ methods NNS of IN misuse NN detection NN , , including VVG a DT new JJ pattern NN matching VVG model NN are VBP discussed VVN later RBR . SENT A DT block NN diagram NN of IN a DT typical JJ misuse NN detection NN system NN is VBZ shown VVN in IN Figure NP 2 CD below RB . SENT Anomaly NN Detection NN Systems NNS There EX have VHP been VBN a DT few JJ major JJ approaches NNS to TO anomaly NN intrusion NN detection NN systems NNS , , some DT of IN which WDT are VBP described VVN below RB . SENT Statistical JJ approaches NNS . SENT In IN this DT method NN , , initially RB , , behavior NN profiles NNS for IN subjects NNS are VBP generated VVN . SENT As IN the DT system NN continues VVZ running VVG , , the DT anomaly NN detector NN constantly RB generates VVZ the DT variance NN of IN the DT present JJ profile NN from IN the DT original JJ one NN . SENT We PP note VVP that IN , , in IN this DT case NN , , there EX may MD be VB several JJ measures NNS that WDT affect VVP the DT behavior NN profile NN , , like IN activity NN measures NNS , , CPU NN time NN used VVN , , number NN of IN network NN connections NNS in IN a DT time NN period NN , , etc FW . SENT In IN some DT systems NNS , , the DT current JJ profile NN and CC the DT previous JJ profile NN are VBP merged VVN at IN intervals NNS , , but CC in IN some DT other JJ systems NNS profile NN generation NN is VBZ a DT one CD time NN activity NN . SENT The DT main JJ advantage NN to TO statistical JJ systems NNS is VBZ that IN they PP adaptively RB learn VVP the DT behavior NN of IN users NNS . SENT they PP are VBP thus RB potentially RB more JJR sensitivte NN than IN human JJ experts NNS . SENT However RB there EX are VBP a DT few JJ problems NNS with IN statistical JJ approaches NNS . SENT they PP can MD gradually RB be VB trained VVN by IN intruders NNS so RB that IN eventually RB , , intrusive JJ events NNS are VBP considered VVN normal JJ , , false JJ positives NNS and CC false JJ negatives NNS are VBP generated VVN depending VVG on IN whether IN the DT threshold NN is VBZ set VVN too RB low JJ or CC too RB high JJ , , and CC relationships NNS between IN events NNS are VBP missed VVN because IN of IN the DT insensitivity NN of IN statistical JJ measures NNS to TO the DT order NN of IN events NNS . SENT An DT open JJ issue NN with IN statistical JJ approaches NNS in IN particular JJ , , and CC anomaly NN detection NN systems NNS in IN general JJ , , is VBZ the DT selection NN of IN measures NNS to TO monitor VV . SENT It PP is VBZ not RB known VVN exactly RB what WP the DT subset NN of IN all DT possible JJ measures NNS that WDT accurately RB predicts VVZ intrusive JJ activities NNS is VBZ . SENT Static JJ methods NNS of IN determining VVG these DT measures NNS are VBP sometimes RB misleading VVG because IN of IN the DT unique JJ features NNS of IN a DT particular JJ system NN . SENT Thus RB , , it PP seems VVZ that IN a DT combination NN of IN static JJ and CC dynamic JJ determination NN of IN the DT set NN of IN measures NNS should MD be VB done VVN . SENT Some DT problems NNS associated VVN with IN this DT technique NN have VHP been VBN remedied VVN by IN other JJ methods NNS , , including VVG the DT method NN involving VVG Predictive JJ Pattern NN Generation NP , , which WDT takes VVZ past JJ events NNS into IN account NN when WRB analyzing VVG the DT data NNS . SENT Predictive JJ pattern NN generation NN . SENT This DT method NN of IN intrusion NN detection NN tries VVZ to TO predict VV future JJ events NNS based VVN on IN the DT events NNS that WDT have VHP already RB occurred VVN 14 CD . SENT Therefore RB , , we PP could MD have VH a DT rule NN E NP 1 CD E NN 2 CD E NN 3 CD 80 CD , , E NP 4 CD 15 CD , , E NP 5 CD 5 CD This DT would MD mean VV that IN given VVN that IN events NNS E NP 1 CD and CC E NP 2 CD have VHP occurred VVN , , with IN E NP 2 CD occurring VVG after IN E NP 1 CD , , there EX is VBZ an DT 80 CD probability NN that IN event NN E NP 3 CD will MD follow VV , , a DT 15 CD chance NN that IN event NN E NP 4 CD will MD follow VV and CC a DT 5 CD probability NN that IN event NN E NP 5 CD will MD follow VV . SENT The DT problem NN with IN this DT is VBZ that IN some DT intrusion NN scenarios NNS that WDT are VBP not RB described VVN by IN the DT rules NNS will MD not RB be VB flagged VVN intrusive JJ . SENT Thus RB , , if IN an DT event NN sequence NN A DT B NP C NP exists VVZ that DT is VBZ intrusive JJ , , but CC not RB listed VVN in IN the DT rulebase NN , , it PP will MD be VB classified VVN as RB unrecognized JJ . SENT This DT problem NN can MD be VB partially RB solved VVN by IN flagging JJ any DT unknown JJ events NNS as IN intrusions NNS increasing VVG the DT probability NN of IN false JJ positives NNS , , or CC by IN flagging VVG them PP as IN non JJ intrusive JJ thus RB increasing VVG the DT probability NN of IN false JJ negatives NNS . SENT In IN the DT normal JJ case NN , , however RB , , an DT event NN is VBZ flagged VVN intrusive JJ if IN the DT left JJ hand NN side NN of IN a DT rule NN is VBZ matched VVN , , but CC the DT right JJ hand NN side NN is VBZ statistically RB very RB deviant JJ from IN the DT prediction NN . SENT There EX are VBP several JJ advantages NNS to TO this DT approach NN . SENT First RB , , rule VV based VVN sequential JJ patterns NNS can MD detect VV anomalous JJ activities NNS that WDT were VBD difficult JJ with IN traditional JJ methods NNS . SENT Second RB , , systems NNS built VVD using VVG this DT model NN are VBP highly RB adaptive JJ to TO changes NNS . SENT This DT is VBZ because RB low JJ quality NN patterns NNS are VBP continuously RB eliminated VVN , , finally RB leaving VVG the DT higher JJR quality NN patterns NNS behind RB . SENT Third JJ , , it PP is VBZ easier JJR to TO detect VV users NNS who WP try VVP to TO train VV the DT system NN during IN its PP$ learning VVG period NN . SENT And CC fourth JJ , , anomalous JJ activities NNS can MD be VB detected VVN and CC reported VVN within IN seconds NNS of IN receiving VVG audit NN events NNS . SENT Another DT approach NN taken VVN in IN intrusion NN detection NN systems NNS is VBZ the DT use NN of IN neural JJ networks NNS . SENT The DT idea NN here RB is VBZ to TO train VV the DT neural JJ network NN to TO predict VV a DT user's JJ next JJ action NN or CC command NN , , given VVN the DT window NN of IN n NN previous JJ actions NNS or CC commands NNS . SENT The DT network NN is VBZ trained VVN on IN a DT set NN of IN representative JJ user NN commands NNS . SENT After IN the DT training NN period NN , , the DT network NN tries VVZ to TO match VV actual JJ commands NNS with IN the DT actual JJ user NN profile NN already RB present JJ in IN the DT net NN . SENT Any DT incorrectly RB predicted VVN events NNS events NNS and CC commands NNS are VBP used VVN interchangeably RB in IN this DT discussion NN actually RB measure VV the DT deviation NN of IN the DT user NN from IN the DT established JJ profile NN . SENT Some DT advantages NNS of IN using VVG neural JJ networks NNS are VBP . SENT 8 CD they PP cope VV well RB with IN noisy JJ data NNS , , their PP$ success NN does VVZ not RB depend VV on IN any DT statistical JJ assumption NN about IN the DT nature NN of IN the DT underlying JJ data NNS , , and CC they PP are VBP easier JJR to TO modify VV for IN new JJ user NN communities NNS . SENT However RB , , they PP have VHP some DT problems NNS . SENT First RB , , a DT small JJ window NN will MD result VV in IN false JJ positives NNS while IN a DT large JJ window NN will MD result VV in IN irrelevant JJ data NNS as IN well RB as RB increase VV the DT chance NN of IN false JJ negatives NNS . SENT Second RB , , the DT net JJ topology NN is VBZ only RB determined VVN after IN considerable JJ trial NN and CC error NN . SENT And CC third JJ , , the DT intruder NN can MD train VV the DT net NN during IN its PP$ learning VVG phase NN . SENT Misuse NN Detection NN Systems NNS There EX has VHZ been VBN significant JJ research NN in IN misuse NN detection NN systems NNS in IN the DT recent JJ past NN , , including VVG attempts NNS at IN SRI NN , , Purdue NP University NP and CC the DT University NP of IN California NP Davis NP . SENT Some DT of IN these DT systems NNS are VBP explained VVN in IN depth NN in IN this DT section NN . SENT Expert NN systems NNS are VBP modeled VVN in IN such PDT a DT way NN as RB to TO separate VV the DT rule NN matching VVG phase NN from IN the DT action NN phase NN . SENT The DT matching NN is VBZ done VVN according VVG to TO audit VV trail NN events NNS . SENT The DT Next NP Generation NP Intrusion NN Detection NN Expert JJ System NP NIDES NNS developed VVN by IN SRI NN is VBZ an DT interesting JJ case NN study NN for IN the DT expert JJ system NN approach NN . SENT NIDES NNS follows VVZ a DT hybrid JJ intrusion NN detection NN technique NN consisting VVG of IN a DT misuse NN detection NN component NN as RB well RB as IN an DT anomaly NN detection NN component NN . SENT The DT anomaly NN detector NN is VBZ based VVN on IN the DT statistical JJ approach NN , , and CC it PP flags VVZ events NNS as IN intrusive JJ if IN they PP are VBP largely RB deviant JJ from IN the DT expected VVN behavior NN . SENT To TO do VV this DT , , it PP builds VVZ user NN profiles NNS based VVN on IN many JJ different JJ criteria NNS more JJR than IN 30 CD criteria NNS , , including VVG CPU NN and CC I NN O NN usage NN , , commands VVZ used VVN , , local JJ network NN activity NN , , system NN errors NNS etc NN . SENT 8 CD . SENT These DT profiles NNS are VBP updated VVN at IN periodic JJ intervals NNS . SENT The DT expert NN system NN misuse NN detection NN component NN encodes VVZ known VVN intrusion NN scenarios NNS and CC attack NN patterns NNS bugs NNS in IN old JJ versions NNS of IN sendmail NN could MD be VB one CD vulnerability NN . SENT The DT rule NN database NN can MD be VB changed VVN for IN different JJ systems NNS . SENT One CD advantage NN of IN the DT NIDES NNS approach NN is VBZ that IN it PP has VHZ a DT statistical JJ component NN as IN well RB as IN an DT expert JJ system NN component NN . SENT This DT means VVZ that IN the DT chances NNS of IN one CD system NN catching VVG intrusions NNS missed VVN by IN the DT other JJ increase NN . SENT Another DT advantage NN is VBZ the DT problem's JJ control NN reasoning NN is VBZ cleanly RB separated VVN from IN the DT formulation NN of IN the DT solution NN . SENT There EX are VBP some DT draw NN backs VVZ to TO the DT expert NN system NN approach NN too RB . SENT For IN example NN , , the DT expert NN system NN has VHZ to TO be VB formulated VVN by IN a DT security NN professional JJ and CC thus RB the DT system NN is VBZ only RB as RB strong JJ as IN the DT security NN personnel NNS who WP programs VVZ it PP 7 CD . SENT This DT means VVZ that IN there EX is VBZ a DT real JJ chance NN that IN expert NN systems NNS can MD fail VV to TO flag NN intrusions NNS . SENT It PP is VBZ for IN this DT reason NN that IN NIDES NNS has VHZ an DT anomaly NN as RB well RB as IN a DT misuse NN detection NN component NN . SENT These DT two CD components NNS are VBP loosely RB coupled VVN in IN the DT sense NN that IN they PP perform VVP their PP$ operations NNS independently RB for IN the DT most JJS part NN . SENT The DT NIDES NNS system NN runs VVZ on IN a DT machine NN different JJ from IN the DT machine NN s PP to TO be VB monitored VVN , , which WDT could MD be VB unreasonable JJ overhead NN . SENT Furthermore RB , , additions NNS and CC deletions NNS of IN rules NNS from IN the DT rule NN base NN must MD take VV into IN account NN the DT inter VV dependencies NNS between IN different JJ rules NNS in IN the DT rule NN base NN . SENT And CC there EX is VBZ no DT recognition NN of IN the DT sequential JJ ordering VVG of IN data NNS , , because IN the DT various JJ conditions NNS that WDT make VVP up RP a DT rule NN are VBP not RB recognized VVN to TO be VB ordered VVN . SENT Keystroke NN monitoring NN is VBZ a DT very RB simple JJ technique NN that WDT monitors VVZ keystrokes NNS for IN attack NN patterns NNS . SENT Unfortunately RB the DT system NN has VHZ several JJ defects NNS features NNS of IN shells NNS like IN bash NN , , ksh NN , , and CC tcsh NN in IN which WDT user NN definable JJ aliases NNS are VBP present JJ defeat NN the DT technique NN unless IN alias NN expansion NN and CC semantic JJ analysis NN of IN the DT commands NNS is VBZ taken VVN up RP . SENT The DT method NN also RB does VVZ not RB analyze VV the DT running NN of IN a DT program NN , , only RB the DT keystrokes NNS . SENT This DT means VVZ that IN a DT malicious JJ program NN cannot NN be VB flagged VVN for IN intrusive JJ activities NNS . SENT Operating NN systems NNS do VVP not RB offer VV much JJ support NN for IN keystroke NN capturing VVG , , so RB the DT keystroke NN monitor NN should MD have VH a DT hook NN that IN analyses NNS keystrokes NNS before IN sending VVG them PP on IN to TO their PP$ intended JJ receiver NN . SENT An DT improvement NN to TO this DT would MD be VB to TO monitor VV system NN calls NNS by IN application NN programs NNS as IN well RB , , so RB that IN an DT analysis NN of IN the DT program's JJ execution NN is VBZ possible JJ . SENT Model NN Based VVN Intrusion NN Detection NN states NNS that IN certain JJ scenarios NNS are VBP inferred VVN by IN certain JJ other JJ observable JJ activities NNS . SENT If IN these DT activities NNS are VBP monitored VVN , , it PP is VBZ possible JJ to TO find VV intrusion NN attempts NNS by IN looking VVG at IN activities NNS that WDT infer VV a DT certain JJ intrusion NN scenario NN . SENT The DT model NN based VVN scheme NN consists VVZ of IN three CD important JJ modules NNS 4 CD . SENT The DT anticipator NN uses VVZ the DT active JJ models NNS and CC the DT scenario NN models NNS to TO try VV to TO predict VV the DT next JJ step NN in IN the DT scenario NN that WDT is VBZ expected VVN to TO occur VV . SENT A DT scenario NN model NN is VBZ a DT knowledge NN base NN with IN specifications NNS of IN intrusion NN scenarios NNS . SENT The DT planner NN then RB translates VVZ this DT hypothesis NN into IN a DT format NN that WDT shows VVZ the DT behavior NN as IN it PP would MD occur VV in IN the DT audit NN trail NN . SENT It PP uses VVZ the DT predicted VVN information NN to TO plan VV what WP to TO search VV for IN next JJ . SENT The DT interpreter NN then RB searches VVZ for IN this DT data NNS in IN the DT audit NN trail NN . SENT The DT system NN proceeds VVZ this DT way NN , , accumulating VVG more JJR and CC more JJR evidence NN for IN an DT intrusion NN attempt NN until IN a DT threshold NN is VBZ crossed VVN . SENT at IN this DT point NN , , it PP signals VVZ an DT intrusion NN attempt NN . SENT This DT is VBZ a DT very RB clean JJ approach NN . SENT Because IN the DT planner NN and CC the DT interpreter NN know VVP what WP they PP are VBP searching VVG for IN at IN each DT step NN , , the DT large JJ amounts NNS of IN noise NN present NN in IN audit NN data NNS can MD be VB filtered VVN , , leading VVG to TO excellent JJ performance NN improvements NNS . SENT In IN addition NN , , the DT system NN can MD predict VV the DT attacker's JJ next JJ move NN based VVN on IN the DT intrusion NN model NN . SENT These DT predictions NNS can MD be VB used VVN to TO verify VV an DT intrusion NN hypothesis NN , , to TO take VV preventive JJ measures NNS , , or CC to TO determine VV what WP data NNS to TO look VV for IN next JJ . SENT However RB , , there EX are VBP some DT critical JJ issues NNS related VVN to TO this DT system NN . SENT First RB , , patterns NNS for IN intrusion NN scenarios NNS must MD be VB easily RB recognized VVN . SENT Second RB , , patterns NNS must MD always RB occur VV in IN the DT behavior NN being VBG looked VVN for IN . SENT And CC finally RB , , patterns NNS must MD be VB distinguishing VVG . SENT they PP must MD not RB be VB associated VVN with IN any DT other JJ normal JJ behavior NN . SENT In IN the DT State NP Transition NN Analysis NN technique NN , , the DT monitored JJ system NN is VBZ represented VVN as IN a DT state NN transition NN diagram NN . SENT As IN data NNS is VBZ analyzed VVN , , the DT system NN makes VVZ transitions NNS from IN one CD state NN to TO another DT . SENT A DT transition NN takes VVZ place NN on IN some DT Boolean NP condition NN being VBG true JJ for IN example NN , , the DT user NN opening VVG a DT file NN . SENT The DT approach NN followed VVN in IN USTAT NP 5 CD is VBZ to TO have VH state NN transitions NNS from IN safe JJ to TO unsafe JJ states NNS based VVN on IN known VVN attack NN patterns NNS . SENT To TO make VV this DT model NN clearer JJR , , we PP illustrate VVP with IN an DT example NN based VVN almost RB entirely RB on IN an DT example NN in IN Ilgun's NP thesis NN . SENT The DT attacker NN creates VVZ a DT link NN starting VVG with IN say VVP x NN to TO root's NNS setuid JJ shell NN script NN containing VVG the DT . SENT bin NN sh NN mechanism NN . SENT The DT attacker NN executes VVZ x NN . SENT The DT point NN of IN this DT attack NN is VBZ that IN whenever WRB a DT hard JJ link NN to TO a DT file NN is VBZ created VVN , , a DT new JJ inode NN with IN the DT target's JJ original JJ permissions NNS is VBZ created VVN . SENT Since IN invoking VVG a DT script NN with IN the DT . SENT bin NN sh NN mechanism NN ianvokes VVZ a DT subshell NN , , and CC further RBR , , if IN the DT name NN of IN the DT subshell NN begins VVZ with IN a DT dash NN an DT interactive JJ shell NN is VBZ created VVN , , we PP see VVP that IN the DT attacker NN has VHZ obtained VVN an DT interactive JJ shell NN with IN root NN privileges NNS . SENT The DT state NN diagram NN for IN this DT is VBZ shown VVN in IN Figure NP 3 CD . SENT We PP see VVP that IN for IN the DT final JJ compromised VVN state NN to TO be VB reached VVN , , some DT conditions NNS have VHP to TO be VB fulfilled VVN . SENT If IN these DT guard NN conditions NNS are VBP true JJ , , then RB there EX is VBZ almost RB certainly RB an DT intrusion NN attempt NN going VVG on IN . SENT However RB , , if IN any DT of IN these DT conditions NNS do VVP not RB hold VV , , the DT probability NN of IN an DT intrusive JJ action NN is VBZ considerably RB decreased VVN . SENT We PP see VVP that IN the DT guard NN conditions NNS exist VVP to TO filter VV the DT intrusive JJ activities NNS from IN the DT non JJ intrusive JJ ones NNS . SENT Hence RB , , this DT can MD serve VV as IN a DT data NNS pruning VVG mechanism NN as RB observed VVD in IN the DT model NN based VVN scheme NN above IN . SENT Some DT advantages NNS of IN this DT approach NN are VBP . SENT it PP can MD detect VV co NP operative JJ attacks NNS , , it PP can MD detect VV attacks NNS that WDT span VVP across IN multiple JJ user NN sessions NNS , , and CC it PP can MD foresee VV impending JJ compromise NN situations NNS based VVN on IN the DT present JJ system NN state NN and CC take VV pre NP emptive JJ measures NNS . SENT However RB there EX are VBP also RB a DT few JJ problems NNS with IN state NN transition NN systems NNS . SENT First RB , , attack NN patterns NNS can MD specify VV only RB a DT sequence NN of IN events NNS , , rather RB than IN more JJR complex JJ forms NNS . SENT Second RB , , there EX are VBP no DT general JJ purpose NN methods NNS to TO prune VV the DT search NN except IN through IN the DT assertion NN primitives NNS described VVD above IN . SENT And CC finally RB , , they PP cannot NN detect VV denial NN of IN service NN attacks NNS , , failed VVD logins NP , , variations NNS from IN normal JJ usage NN , , and CC passive JJ listening VVG this DT is VBZ because IN these DT items NNS are VBP either RB not RB recorded VVN by IN the DT audit NN trail NN mechanism NN , , or CC they PP cannot NN be VB represented VVN by IN state NN transition NN diagrams NNS . SENT A DT small JJ point NN to TO be VB noted VVN is VBZ that IN USTAT NP was VBD never RB meant VVN to TO be VB a DT stand NN alone RB intrusion NN detection NN system NN . SENT indeed RB , , it PP is VBZ meant VVN to TO be VB used VVN with IN an DT anomaly NN detector NN so IN that DT more JJR intrusion NN attempts NNS may MD be VB detected VVN by IN their PP$ combination NN . SENT Some DT of IN the DT weaknesses NNS of IN state NN transition NN systems NNS are VBP remedied VVN by IN the DT Pattern NN Matching VVG Model NP , , discussed VVD next JJ . SENT Kumar NP 6 CD proposed VVD a DT new JJ misuse NN detection NN system NN based VVN on IN Pattern NN Matching NN . SENT This DT model NN encodes VVZ known VVN intrusion NN signatures NNS as IN patterns NNS that WDT are VBP then RB matched VVN against IN the DT audit NN data NNS . SENT Like IN the DT state NN transition NN analysis NN model NN , , this DT model NN attempts VVZ to TO match VV incoming JJ events NNS to TO the DT patterns NNS representing VVG intrusion NN scenarios NNS . SENT The DT implementation NN makes VVZ transitions NNS on IN certain JJ events NNS , , called VVN labels NNS , , and CC Boolean NP variables NNS called VVD guards NNS can MD be VB placed VVN at IN each DT transition NN . SENT The DT difference NN between IN this DT and CC the DT state NN transition NN model NN is VBZ that IN the DT state NN transition NN model NN associates NNS these DT guards NNS with IN states NNS , , rather RB than IN transitions NNS . SENT The DT important JJ advantages NNS of IN this DT model NN are VBP . SENT Declarative JJ Specification NN . SENT It PP only RB needs VVZ to TO be VB specified VVN what WDT patterns NNS need VVP to TO be VB matched VVN , , not RB how WRB to TO match VV them PP . SENT Multiple JJ event NN streams NNS can MD be VB used VVN together RB to TO match VV against IN patterns NNS for IN each DT stream NN without IN the DT need NN to TO combine VV streams NNS . SENT This DT means VVZ that DT streams NNS can MD be VB processed VVN independently RB , , and CC their PP$ results NNS can MD be VB analyzed VVN together RB to TO give VV evidence NN of IN intrusive JJ activity NN . SENT Portability NN . SENT Since IN intrusion NN signatures NNS are VBP written VVN in IN a DT system NN independent JJ script NN , , they PP need MD not RB be VB rewritten VVN for IN different JJ audit NN trails NNS . SENT The DT patterns NNS declarative JJ specifications NNS enable VVP them PP to TO be VB exchanged VVN across IN different JJ Operating VVG Systems NPS and CC different JJ audit NN trails NNS . SENT It PP has VHZ excellent JJ real JJ time NN capabilities NNS . SENT Kumar NP reports VVZ a DT CPU NN overhead NN of IN 5 CD 6 CD when WRB scanning VVG for IN 100 CD different JJ patterns NNS , , which WDT is VBZ excellent JJ . SENT It PP can MD detect VV some DT attack NN signatures NNS like IN the DT failed JJ logins NP signature NN that IN the DT state NN transition NN model NN cannot NN do VVP . SENT One CD problem NN with IN this DT model VV it PP it PP can MD only RB detect VV attacks NNS based VVN on IN known VVN vulnerabilities NNS a DT problem NN with IN misuse NN detection NN systems NNS in IN general NN In IN addition NN , , pattern NN matching NN is VBZ not RB very RB useful JJ for IN representing VVG ill JJ defined VVN patterns NNS and CC it PP is VBZ not RB an DT easy JJ task NN to TO translate VV known VVN attack NN scenarios NNS into IN patterns NNS that WDT can MD be VB used VVN by IN the DT model NN . SENT Also RB , , it PP cannot NN detect VV passive JJ wire NN tapping VVG intrusions NNS , , nor CC can MD in RB detect VV spoofing VVG attacks NNS where WRB a DT machine NN pretends VVZ to TO be VB another DT machine NN by IN using VVG its PP$ IP NP address NN . SENT An DT interesting JJ fact NN about IN Kumar's NP IDS NP is VBZ that IN it PP is VBZ called VVN IDIOT NN Intrusion NN Detection NN In IN Our PP$ Time NN , , and CC we PP leave VVP it PP to TO the DT reader NN to TO ponder VV the DT appropriateness NN of IN the DT name NN for IN the DT state NN of IN the DT art NN in IN intrusion NN detection NN . SENT 6 CD Other JJ Models NNS and CC Directions NNS in IN Research NP Dorothy NP Denning NP 3 CD introduced VVD a DT Generic JJ Intrusion NN Detection NN Model NP that WDT was VBD independent JJ of IN any DT particular JJ system NN , , application NN environment NN , , system NN vulnerability NN , , or CC type NN of IN intrusion NN . SENT The DT basic JJ idea NN of IN the DT model NN is VBZ to TO maintain VV a DT set NN of IN profiles NNS for IN subjects NNS usually RB , , but CC not RB necessarily RB users NNS of IN a DT system NN . SENT When WRB an DT audit NN record NN is VBZ generated VVN , , the DT model NN matches VVZ it PP with IN the DT appropriate JJ profile NN and CC then RB makes VVZ decisions NNS on IN updating VVG the DT profile NN , , checking VVG for IN abnormal JJ behavior NN and CC reporting NN anomalies NNS detected VVD . SENT To TO do VV this DT , , it PP monitors VVZ system NN services NNS such JJ as IN file NN accesses NNS , , executable JJ programs NNS , , and CC logins NP . SENT It PP has VHZ no DT specific JJ knowledge NN of IN the DT target NN system's NN vulnerabilities NNS , , although IN this DT knowledge NN would MD be VB extremely RB useful JJ in IN making VVG the DT model NN more RBR valuable JJ . SENT In IN fact NN , , the DT Intrusion NN Detection NN Expert JJ System NP IDES NNS developed VVN at IN SRI NN was VBD based VVN on IN this DT model NN . SENT The DT basic JJ ideas NNS in IN this DT model NN appear VVP with IN little JJ modification NN in IN many JJ systems NNS built VVN . SENT However RB , , there EX are VBP some DT systems NNS that WDT do VVP not RB fit VV easily RB into IN this DT model NN . SENT NSM NN Network NP Security NP Monitor NP is VBZ an DT intrusion NN detection NN system NN developed VVN at IN the DT University NP of IN California NP Davis NP . SENT NSM NN is VBZ a DT network NN based VVN IDS NP that WDT differs VVZ from IN all DT of IN the DT IDSs NP discussed VVD earlier RBR because IN it PP does VVZ not RB use VV or CC analyze VV the DT host NN machine NN s PP audit VV trails NNS . SENT Rather RB , , it PP monitors VVZ network NN traffic NN in IN order NN to TO detect VV intrusions NNS 9 CD . SENT Since IN network NN based VVN attacks NNS are VBP expected VVN to TO be VB prevalent JJ in IN the DT future NN due JJ to TO the DT mushrooming VVG of IN the DT Internet NN , , NSM NN could MD prove VV to TO be VB a DT valuable JJ tool NN to TO detect VV intrusive JJ activity NN . SENT NSM NN has VHZ several JJ perceived VVN advantages NNS . SENT First RB , , the DT IDS NP gets VVZ instantaneous JJ access NN to TO network NN data NNS . SENT Second RB , , the DT IDS NP is VBZ hidden VVN from IN the DT intruder NN because IN it PP is VBZ passively RB listening VVG to TO network NN traffic NN . SENT Therefore RB , , it PP cannot NN be VB shut VVN off RP or CC its PP$ data NNS compromised VVN . SENT Finally RB , , the DT IDS NP can MD be VB used VVN with IN any DT system NN , , because IN it PP is VBZ monitoring VVG network NN traffic NN , , protocols NNS for IN which WDT TCP NN , , UDP NP etc FW . SENT are VBP standardized JJ . SENT There EX is VBZ no DT problem NN with IN different JJ audit NN files NNS , , for IN example NN . SENT Researchers NNS at IN Purdue NP University NP are VBP working VVG on IN several JJ issues NNS in IN intrusion NN detection NN . SENT Crosbie NP and CC Spafford NP 2 CD propose VVP to TO build VV an DT IDS NP using VVG Autonomous JJ Agents NNS . SENT Instead RB of IN a DT single JJ large JJ IDS NP defending VVG the DT system NN , , they PP propose VVP an DT approach NN where WRB several JJ independent JJ , , small JJ processes NNS operate VVP while IN co NP operating VVG in IN maintaining VVG the DT system NN . SENT The DT advantages NNS claimed VVD for IN this DT approach NN are VBP efficiency NN , , fault NN tolerance NN , , resilience NN to TO degradation NN , , extensibility NN and CC scalability NN . SENT The DT foreseen VVN drawbacks NNS include VVP the DT overhead NN of IN so RB many JJ processes NNS , , long JJ training NN times NNS , , and CC the DT fact NN that IN if IN the DT system NN is VBZ subverted VVN , , it PP becomes VVZ a DT security NN liability NN . SENT An DT interesting JJ possibility NN they PP open VVP up RB is VBZ that IN of IN an DT active JJ defense NN , , that WDT can MD respond VV to TO intrusions NNS actively RB instead RB of IN passively RB reporting VVG them PP it PP could MD kill VV suspicious JJ connections NNS , , for IN example NN . SENT Conclusion NN Intrusion NN Detection NN is VBZ still RB a DT fledgling JJ field NN of IN research NN . SENT However RB , , it PP is VBZ beginning VVG to TO assume VV enormous JJ importance NN in IN today's NNS computing VVG environment NN . SENT The DT combination NN of IN facts NNS such JJ as IN the DT unbridled JJ growth NN of IN the DT Internet NN , , the DT vast JJ financial JJ possibilities NNS opening VVG up RP in IN electronic JJ trade NN , , and CC the DT lack NN of IN truly RB secure JJ systems NNS make VVP it PP an DT important JJ and CC pertinent JJ field NN of IN research NN . SENT Future JJ research NN trends NNS seem VVP to TO be VB converging VVG towards IN a DT model NN that WDT is VBZ a DT hybrid NN of IN the DT anomaly NN and CC misuse NN detection NN models NNS . SENT it PP is VBZ slowly RB acknowledged VVN that IN neither CC of IN the DT models NNS can MD detect VV all DT intrusion NN attempts VVZ on IN their PP$ own JJ . SENT This DT approach NN has VHZ been VBN successfully RB adopted VVN in IN NIDES NNS , , and CC we PP can MD expect VV more JJR such JJ attempts NNS in IN the DT future NN . SENT Some DT schools NNS doing VVG research NN in IN this DT field NN include VVP The DT COAST NN group NN at IN Purdue NP University NP , , The DT University NP of IN California NP Davis NP , , and CC The DT University NP of IN California NP Santa NP Barbara NP . SENT The DT interested JJ reader NN is VBZ encouraged VVN to TO browse VV the DT provided VVN links NNS for IN more JJR information NN . SENT References NNS J NP . SENT P NN Anderson NP . SENT Computer NP Security NP Threat NP Monitoring NN and CC Surveillance NN . SENT Technical JJ report NN , , James NP P NN Anderson NP Co NP . SENT , , Fort NP Washington NP , , Pennsylvania NP , , April NP 1980 CD . SENT Mark NP Crosbie NP and CC Eugene NP Spafford NP . SENT Defending VVG a DT Computer NP System NP Using VVG Autonomous JJ Agents NNS . SENT Technical NP Report NP CSD NP TR NP 95 CD 022 CD , , Department NP of IN Computer NP Sciences NPS , , Purdue NP University NP , , 1995 CD . SENT Dorothy NP E NP Denning NP . SENT An DT Intrusion NN Detection NN Model NP . SENT In IN IEEE NP Transactions NNS on IN Software NP Engineering NP , , Number NP 2 CD , , page NN 222 CD , , February NP 1987 CD . SENT T NN D NP Garvey NP and CC Teresa NP F NP Lunt NP . SENT Model NN based VVN intrusion NN detection NN . SENT In IN Proceedings NNS of IN the DT 14 CD th NN National NP Computer NP Security NP Conference NP , , pages NNS 372 CD 385 CD , , October NP 1991 CD . SENT Koral NP Ilgun NP . SENT USTAT NP A NP Real NP time NN Intrusion NN Detection NN System NP for IN UNIX NP . SENT Master's NP Thesis NN , , University NP of IN California NP at IN Santa NP Barbara NP , , November NP 1992 CD . SENT Sandeep NP Kumar NP . SENT Classification NN and CC Detection NN of IN Computer NP Intrusions NNS . SENT Ph NN . SENT D SYM . SENT Dissertation NN , , August NP 1995 CD . SENT Teresa NP F NP Lunt NP . SENT Detecting VVG Intruders NNS in IN Computer NP Systems NPS . SENT Conference NN on IN Auditing NN and CC Computer NP Technology NP , , 1993 CD . SENT Teresa NP F NP Lunt NP . SENT A DT survey NN of IN intrusion NN detection NN techniques NNS . SENT In IN Computers NP and CC Security NP , , 12 CD 1993 CD , , pages NNS 405 CD 418 CD . SENT Biswanath NP Mukherjee NP , , L NP Todd NP Heberlein NP and CC Karl NP N NP Levitt NP . SENT Network NN Intrusion NN Detection NN , , IEEE NP Network NP , , May NP June NP 1994 CD , , pages NNS 26 CD 41 CD . SENT Barton NP P NN Miller NP , , David NP Koski NP , , Cjin NP Pheow NP Lee NP , , Vivekananda NP Maganty NP , , Ravi NP Murthy NP , , Ajitkumar NP Natarajan NP , , Jeff NP Steidl NP . SENT Fuzz VV Revisited NP . SENT A DT Re NP examination NN of IN the DT Reliability NN of IN UNIX NP Utilities NPS and CC Services NPS . SENT Computer NP Sciences NPS Department NP , , University NP of IN Wisconsin NP , , 1995 CD . SENT Steven NP E NP Smaha NP . SENT Haystack NN . SENT An DT Intrusion NN Detection NN System NP . SENT In IN Fourth JJ Aerospace NP Computer NP Security NP Applications NP Conference NP , , pages NNS 37 CD 44 CD , , Tracor NP Applied NP Science NP Inc NP . SENT , , Austin NP , , Texas NP , , December NP 1988 CD . SENT Eugene NP H NP Spafford NP . SENT The DT Internet NP Worm NP Program NP . SENT An DT Analysis NN . SENT In IN ACM NP Computer NP Communication NP Review NP . SENT 19 CD 1 CD , , pages NNS 17 CD 57 CD , , Jan NP 1989 CD . SENT Eugene NP H NP Spafford NP . SENT Security NN Seminar NN , , Department NP of IN Computer NP Sciences NPS , , Purdue NP University NP , , Jan NP 1996 CD . SENT Henry NP S NP Teng NP , , Kaihu NP Chen NP and CC Stephen NP C NP Lu NP . SENT Security NP Audit NP Trail NP Analysis NP Using VVG Inductively RB Generated VVN Predictive JJ Rules NNS . SENT In IN Proceedings NNS of IN the DT 11 CD th NN National NP Conference NP on IN Artificial JJ Intelligence NP Applications NP , , pages NNS 24 CD 29 CD , , IEEE NP , , IEEE NP Service NP Center NP , , Piscataway NP , , NJ NP , , March NP 1990 CD . SENT Copyright NN 1996 CD by IN Aurobindo NP Sundaram NP Want NP more JJR Crossroads NNS articles NNS about IN Security NP . SENT Go VV to TO the DT index NN or CC the DT next JJ one NN or CC the DT previous JJ one NN . SENT Last RB Modified VVN . SENT Location NN . SENT www JJ . SENT acm NN . SENT org NP crossroads NNS xrds NNS 2 CD 4 CD intrus NN . SENT html NN