Foundations of intrusion detection (computer security)

[1992] Proceedings The Computer Security Foundations Workshop V Pub Date : 1992-06-16 DOI:10.1109/CSFW.1992.236783

P. Helman, G. Liepins, Wynette Richards

引用次数: 22

Abstract

Computer use is modeled as a mixture of two stochastic processes, normal and misuse. Intrusion detection is formally defined as identifying those transactions generated by the misuse process. Bounds for detection performance are derived in terms of the ratios of the densities of the processes at the individual transactions. It is shown that any optimal intrusion detection system must rank transaction suspicion consistently with these ratios. Sparsity of data requires that transactions be grouped into equivalence classes that preserve the order of the true ratio ranking and reduce the number of singleton and unobserved transactions. Results are described that demonstrate that in general this 'singleton reduction' problem is NP-hard.<>

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

入侵检测基础(计算机安全)

计算机的使用被建模为正常和误用两个随机过程的混合。入侵检测被正式定义为识别那些由误用过程产生的事务。检测性能的界限是根据单个事务中进程密度的比率推导出来的。结果表明，任何最优的入侵检测系统都必须与这些比率保持一致。数据的稀疏性要求将事务分组到保持真实比率排序的等价类中，并减少单例和未观察到的事务的数量。结果表明，一般来说，这种“单态约简”问题是np困难的。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文去求助

来源期刊

[1992] Proceedings The Computer Security Foundations Workshop V

自引率

0.00%

发文量

期刊最新文献

Secure dependencies with dynamic level assignments Causal security (computer systems) The inference problem for computer security An algebraic approach to non-interference (computer security) Some laws of non-interference (CSP algebra)