An attack signature model to computer security intrusion detection

• Published in: MILCOM 2002. Proceedings Vol. 2; pp. 1368 - 1373 vol.2
• Main Authors: Cansian, A.M., da Silva, A.R.A., de Souza, M.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 2002
• Subjects: Adaptive systems; Computer networks; Computer security; Engines; Information analysis; Information security; Intrusion detection; Protection; Safety; XML
• ISBN: 0780376250; 9780780376250
• DOI: 10.1109/MILCOM.2002.1179680

Internal and external computer network attacks or security threats occur according to standards and follow a set of subsequent steps, allowing us to establish profiles or patterns. This well-known behavior is the basis of signature analysis intrusion detection systems. This work presents a new attack signature model to be applied on network-based intrusion detection systems engines. The AISF (ACME! Intrusion Signature Format) model is built upon XML technology and works on intrusion signature handling and analysis, from storage to manipulation. Using this new model, the process of storing and analyzing information about intrusion signatures for further use by an IDS become a less difficult and standardized process.