In this paper, we describe a novel approach to policy-based intrusion detection. The model we propose checks legality of information flows between objects in the system, according to an existing security policy specification. These flows are generated by executed system operations. Illegal flows, i.e., not authorized by the security policy, are signaled and considered as intrusion symptoms. This model is able to detect a large class of attacks, referred to as “attacks by delegation” in this paper. Since the approach focuses really on attack effects instead of attack scenarii, unknown attacks by delegation can be detected.
CITATION STYLE
Zimmermann, J., Mé, L., & Bidan, C. (2003). An improved reference flow control model for policy-based intrusion detection. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 2808, pp. 291–308). Springer Verlag. https://doi.org/10.1007/978-3-540-39650-5_17
Mendeley helps you to discover research relevant for your work.