Attack evidence detection, recovery, and signature extraction with ADENOIDS

Abstract

This paper presents the ADENOIDS intrusion detection system (IDS). ADENOIDS takes some architectural inspiration from the human immune system and automates intrusion recovery and attack signature extraction. These features are enabled through attack evidence detection. This IDS is initially designed to deal with application attacks, extracting signature for remote buffer overflow attacks. ADENOIDS is described in this paper and experimental results are also presented. These results show that ADENOIDS can discard false-positives and extract signatures which match the attacks. © Springer-Verlag 2004.