Plan recognition in intrusion detection systems

Abstract

To be effective, current intrusion detection systems (IDSs) must incorporate artificial intelligence methods for plan recognition. Plan recognition is critical both to predicting the future actions of attackers and planning appropriate responses to their actions. However network security places a new set of requirements on plan recognition. We present an argument for including plan recognition in IDSs and an algorithm for conducting plan recognition that meets the needs of the network security domain.