TY - GEN
T1 - Model-driven, network-context sensitive intrusion detection
AU - Massicotte, Frederic
AU - Couture, Mathieu
AU - Briand, Lionel
AU - Labiche, Yvan
PY - 2007
Y1 - 2007
N2 - Intrusion Detection Systems (IDSs) have the reputation of generating many false positives. Recent approaches, known as stateful IDSs, take the state of communication sessions into account to address this issue. A substantial reduction of false positives, however, requires some correlation between the state of the session, known vulnerabilities, and the gathering of more network context information by the IDS than what is currently done (e.g., configuration of a node, its operating system, running applications). In this paper we present an IDS approach that attempts to decrease the number of false positives by collecting more network context and combining this information with known vulnerabilities. The approach is model-driven as it relies on the modeling of packet and network information as UML class diagrams, and the definition of intrusion detection rules as OCL expressions constraining these diagrams. The approach is evaluated using real attacks on real systems, and appears to be promising.
AB - Intrusion Detection Systems (IDSs) have the reputation of generating many false positives. Recent approaches, known as stateful IDSs, take the state of communication sessions into account to address this issue. A substantial reduction of false positives, however, requires some correlation between the state of the session, known vulnerabilities, and the gathering of more network context information by the IDS than what is currently done (e.g., configuration of a node, its operating system, running applications). In this paper we present an IDS approach that attempts to decrease the number of false positives by collecting more network context and combining this information with known vulnerabilities. The approach is model-driven as it relies on the modeling of packet and network information as UML class diagrams, and the definition of intrusion detection rules as OCL expressions constraining these diagrams. The approach is evaluated using real attacks on real systems, and appears to be promising.
KW - Intrusion detection
KW - OCL constraints
KW - UML modeling
UR - http://www.scopus.com/inward/record.url?scp=38049070220&partnerID=8YFLogxK
U2 - 10.1007/978-3-540-75209-7_5
DO - 10.1007/978-3-540-75209-7_5
M3 - Conference contribution
AN - SCOPUS:38049070220
SN - 9783540752080
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 61
EP - 75
BT - Model Driven Engineering Languages and Systems - 10th International Conference, MODELS 2007, Proceedings
PB - Springer Verlag
T2 - 10th International Conference on Model Driven Engineering Languages and Systems, MODELS 2007
Y2 - 30 September 2007 through 5 October 2007
ER -