Blare tools: A policy-based intrusion detection system automatically set by the security policy

Abstract

We present here an intrusion detection system automatically parameterized by the security policy. The main idea consists in monitoring information flows in an operating system in order to detect those not allowed by the security policy. In previous works ([1,2] and [3]), the security policy set at the initialization of the IDS and can not be updated. We focus here on the dynamism of the security policy monitored. © 2009 Springer Berlin Heidelberg.