orchids on the value of rigor in intrusion detection
play

OrchIDS: on the value of rigor in intrusion detection Jean - PowerPoint PPT Presentation

Feb 16, 2023 •147 likes •1.93k views

OrchIDS: on the value of rigor in intrusion detection Jean Goubault-Larrecq CPS, Grenoble, July 08 2014 vendredi 11 juillet 14 Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and

  1. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) Orchids threads: (none) vendredi 11 juillet 14

  2. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=57, euid=500, tgt=58 vendredi 11 juillet 14

  3. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  4. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  5. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  6. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  7. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  8. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  9. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  10. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  11. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  12. How it works Flow of events: open (”/etc/passwd”, ”r”, pid =58, euid =500) ptrace ( SYSCALL , pid =100, 101) ptrace ( ATTACH , pid =57, euid =500, 58) ptrace ( GETREGS , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exec ( prog =”modprobe”, pid =101) ptrace ( POKETEXT , pid =100, 101) ptrace ( ATTACH , pid =100, euid =500, 101) ptrace ( POKETEXT , pid =100, 101) exit ( pid =58) ptrace ( DETACH , pid =100, 101) logged events: ptrace Orchids threads: (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=57, euid=500, tgt=58 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) logged events: pid=100, euid=500, tgt=101 ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 ε (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) pid=100, euid=500, tgt=101 vendredi 11 juillet 14

  13. Related work • P-Best [Lindqvist-Porras 1999] • Statl [Eckmann-Vigna-Kemmerer 2000] • Chronicles [e.g., Morin-Debar 2003] • Lambda [Cuppens-Miege 2002] • Sutekh [Pouzol-Ducassé 2002] • Blare [George-VietTriemTong-Mé 2009] • RV-Monitor [Rosu et al. 2008, 09, 12, 14] • ... and probably many others vendredi 11 juillet 14

  14. Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and algorithms 4. NetEntropy : detecting subverted cryptographic flows 5.Conclusion vendredi 11 juillet 14

  15. Outline 1.A few scary stories about computer security 2. ORCHIDS : an intrusion prevention system 3. Semantics and algorithms 4. NetEntropy : detecting subverted cryptographic flows 5.Conclusion vendredi 11 juillet 14

  16. Semantics, and detection algorithms • Semantics: what should Orchids detect? • Algorithm: how should I detect it? (This is what I showed you.) • Semantics dictates the algorithm. • ... somehow opposite to the average coding attitude • we like to think algorithmically • we are eager to code http://www.sadgrin.com/wp-content/uploads/2013/03/geek-300x300.jpg vendredi 11 juillet 14

  17. Semantics, and detection algorithms • Semantics: what should Orchids detect? • Algorithm: how should I detect it? (This is what I showed you.) • Semantics dictates the algorithm. • ... somehow opposite to the average coding attitude • we like to think algorithmically • we are eager to code http://www.sadgrin.com/wp-content/uploads/2013/03/geek-300x300.jpg vendredi 11 juillet 14

  18. Semantics, 1 • ORCHIDS looks for subsequences of events (« runs ») A A A ptrace ( ATTACH , ...) B ptrace ( DETACH , ...) ptrace ( GETREGS , ...) B B A B A exec (...) B ptrace ( SYSCALL , ...) A ptrace ( POKETEXT , ...) A ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 � (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) vendredi 11 juillet 14

  19. Semantics, 1 • ORCHIDS looks for subsequences of events (« runs ») A A A ptrace ( ATTACH , ...) B ptrace ( DETACH , ...) ptrace ( GETREGS , ...) B B A B A exec (...) B ptrace ( SYSCALL , ...) A ptrace ( POKETEXT , ...) A ptrace (GETREGS, ptrace exec ptrace Pid,Tgt ) ptrace ptrace 1 2 3 4 5 6 7 � (ATTACH, ( Tgt ) (SYSCALL, (POKETEXT, (DETACH, Pid,Euid,Tgt ) Pid,Tgt ) Pid,Tgt ) Pid,Tgt ) vendredi 11 juillet 14

  20. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Here is one: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  21. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Another one: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  22. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) Yet another: A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 A A 1 2 3 vendredi 11 juillet 14

  23. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events • In this (simple) example, many possible runs (even by fixing the start event) A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time A A 1 2 3 vendredi 11 juillet 14

  24. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an (Here, .) iff 1 2 A A A A A A A A A A A A A A A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time starting A run is minimal iff is minimal (w. fixed) and ... ws i 1 . < i k iff A A 1 2 3 vendredi 11 juillet 14

  25. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an Another example: iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 2 3 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  26. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices starting ws i 1 < i 2 < . . . < i k an This one, stops at minimal (=8): iff . < i k iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 4 5 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  27. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an And this one too: iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 4 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  28. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an And again this one! iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  29. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  30. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  31. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 8 but take indices instead of letters... 3 1 2 3 8 D C 1 2 5 8 1 2 7 8 A B • and let’s sort in increasing order 1 2 4 1 4 5 8 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 vendredi 11 juillet 14

  32. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 4 7 8 1 6 7 8 1 2 3 4 5 8 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 1 8 vendredi 11 juillet 14

  33. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 4 5 6 7 8 1 2 3 4 5 6 7 8 1 8 vendredi 11 juillet 14

  34. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 4 5 6 7 8 1 8 vendredi 11 juillet 14

  35. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  36. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 5 8 D C 1 2 7 8 1 2 3 4 5 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 7 8 1 2 3 6 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  37. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 5 8 1 2 7 8 1 2 5 6 7 8 1 2 3 4 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  38. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 7 8 1 2 5 6 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  39. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 7 8 1 4 5 6 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  40. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  41. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  42. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 4 5 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  43. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 6 7 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  44. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 8 1 2 5 6 7 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  45. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 8 1 4 5 6 7 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  46. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  47. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 7 8 D C 1 2 3 4 5 6 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  48. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 5 6 7 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  49. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 8 but take indices instead of letters... 3 1 2 3 4 5 6 7 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  50. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  51. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  52. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  53. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  54. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 The largest 1 4 5 6 7 8 1 4 5 8 1 4 7 8 1 6 7 8 1 8 vendredi 11 juillet 14

  55. The lexicographic ordering A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 • ... or dictionary order 1 2 3 4 5 6 7 8 but take indices instead of letters... 3 1 2 3 4 5 8 D C 1 2 3 4 7 8 1 2 3 6 7 8 A B • and let’s sort in increasing order 1 2 4 1 2 3 8 1 2 5 6 7 8 1 2 5 8 1 2 7 8 The largest The smallest 1 4 5 6 7 8 1 4 5 8 1 4 7 8 ... and most informative 1 6 7 8 1 8 vendredi 11 juillet 14

  56. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  57. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ... ws i 1 . < i k D C iff A B 1 2 4 vendredi 11 juillet 14

  58. Semantics, 2: «shortest runs» • ORCHIDS looks for subsequences of events ching subsequences starting • A run is an increasing sequence of indices ws i 1 < i 2 < . . . < i k an iff A C D C D C D B A A C B D C A 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 We would like to be warned at the earliest possible time The minimal run: 3 starting A run is minimal iff 1 2 3 4 5 6 7 8 is minimal (w. fixed) and ching subsequences starting ws i 1 . < i k D C the sequence ws i 1 < i 2 < . . . < i k an iff is lexicographically minimal iff A B 1 2 4 vendredi 11 juillet 14

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be

Styles of Intrusion Detection Misuse intrusion detection Try to detect things known to be bad Anomaly intrusion detection Try to detect deviations from normal behavior Specification intrusion detection Try to detect

627 views • 15 slides
Intrusion Detection Principles Basics Models of Intrusion Detection

Intrusion Detection Principles Basics Models of Intrusion Detection

Intrusion Detection Principles Basics Models of Intrusion Detection Architecture of an IDS Architecture of an IDS Organization Incident Response Slide #22-1 FEARLESS engineering Principles of Intrusion Detection

744 views • 40 slides
Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection

Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection

Chapter 25: Intrusion Detection Principles Basics Models of Intrusion Detection Architecture of an IDS Organization Incident Response June 2, 2005 ECS 235, Computer and Information Slide #1 Security Principles of

1.38k views • 104 slides
Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion

Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion

Intrusion Detection System Amir Hossein Payberah payberah@yahoo.com 1 Contents Intrusion Detection Systems Tripwire Snort 2 IDS (Definition) Intrusion Detection is the process of monitoring the events occurring in a computer

571 views • 30 slides
Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection

Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection

Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection solution is impossible Good behavior on one system is bad behavior on another Behaviors change and new vulnerabilities are discovered

700 views • 23 slides
Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 239 systems Computer Software Some sample intrusion detection March 9, 2005 systems Lecture 15 Lecture 15 Page 1 Page 2 CS 239, Winter 2005

602 views • 12 slides
Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236

Outline Introduction Intrusion Detection Characteristics of intrusion detection CS 236 systems Computer Software Some sample intrusion detection March 12, 2007 systems Lecture 14 Lecture 14 Page 1 Page 2 CS 236, Winter 2007

537 views • 10 slides
Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative

Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative

Intrusion Detection Intrusion Detection October 23, 2020 Administrative Administrative submittal instructions submittal instructions answer the lab assignments questions in written report form, as a text, pdf, or Word document

504 views • 21 slides
Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing

Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing

Overview Intrusion Detection Systems Intrusion Detection Concepts and Practices Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy Chapter 13 Using Rules and Thresholds for

297 views • 7 slides
Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter

Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter

Intrusion Detection Systems CS 236 On-Line MS Program Networks and Systems Security Peter Reiher Lecture 11 Page 1 CS 236 Online Outline Introduction Characteristics of intrusion detection systems Some sample intrusion detection

143 views • 12 slides
Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion

Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion

Signature Based Intrusion Detection Systems Philip Chan CS 598 MCC Spring 2013 Intrusion Detection Systems Detect malicious Raise alarms activities/attacks Alert administrators Hacking/ unauthorized access Trigger defense

217 views • 21 slides
Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu

Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu

Network Intrusion Detection &amp; Forensics with Bro Matthias Vallentin vallentin@berkeley.edu BERKE1337 March 3, 2016 Outline 1. Intrusion Detection 101 2. Bro 3. Network Forensics Exercises 1 / 29 Detection vs. Blocking Intrusion

432 views • 32 slides
Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International

Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International

Intrusion Prevention and Detection in Grid computing - The ALICE Case 21st International Conference on Computing in High Energy and Nuclear Physics Outline: Introduction Threat model Intrusion prevention Intrusion detection

420 views • 16 slides
Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

ITS335 Intrusion Detection Intruders Intrusion Detection Host-Based Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots Summary Sirindhorn International Institute of Technology Thammasat University

584 views • 30 slides
Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald

Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald

Optimising the resource utilisation in high-speed network intrusion detection systems. Gerald Tripp www.kent.ac.uk Network intrusion detection Network intrusion detection systems are provided to detect the presence of various security

260 views • 12 slides
Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What

Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What

Automobile Intrusion Detection Jun Li Twitter @bravo_fighter UnicornTeam Qihoo360 2 What this talk is about? Automotive intrusion detection Automotive cyber-security architecture From the highest viewpoint J 3 Outline Quick

926 views • 63 slides
100% in main it's a long and winding road but worth it Holger Levsen, August 12 th 2008

100% in main it's a long and winding road but worth it Holger Levsen, August 12 th 2008

aka Debian Edu 100% in main it's a long and winding road but worth it Holger Levsen, August 12 th 2008 About the two names... nowadays Debian Edu and Skolelinux are used as synonyms it's the same project Skolelinux was started

547 views • 44 slides
The long road to aka Debian Edu in Debian Lenny main Holger Levsen, February 24 th 2008

The long road to aka Debian Edu in Debian Lenny main Holger Levsen, February 24 th 2008

The long road to aka Debian Edu in Debian Lenny main Holger Levsen, February 24 th 2008 Outline Some bits about me Project goals, design &amp; features Debian and Debian Edu Development model and tools Debian Edu Etch

582 views • 36 slides
Sage: an open-source mathematical software system Alasdair McAndrew 23 June 2010 / Monash

Sage: an open-source mathematical software system Alasdair McAndrew 23 June 2010 / Monash

Sage: an open-source mathematical software system Alasdair McAndrew 23 June 2010 / Monash University Alasdair McAndrew (VU) Sage: open-source mathematical software 23 June 2010 1 / 36 Outline Mathematics software and me 1 Enter Sage 2

691 views • 46 slides
Some very cool things about Sage Or, why I am excited about Sage Franco V. Saliola

Some very cool things about Sage Or, why I am excited about Sage Franco V. Saliola

Some very cool things about Sage Or, why I am excited about Sage Franco V. Saliola saliola@gmail.com Laboratoire de Combinatoire et dInformatique Math ematique Universit e du Qu ebec ` a Montr eal LaCIM Seminar 7 March

630 views • 52 slides
Anewdeterminationof withcoldrubidium atoms P. Clad S.

Anewdeterminationof withcoldrubidium atoms P. Clad S.

Anewdeterminationof withcoldrubidium atoms P. Clad S. Guellati-Khlifa M. Cadoret C. Schwob E. De Mirandes F. Nez L. Julien F. Biraben Laboratoire Kastler Brossel (ENS, CNRS, UPMC) Institut National de

553 views • 24 slides
Experimental Quantum Physics The starting point Level 0.1: We want to have fun with experimental

Experimental Quantum Physics The starting point Level 0.1: We want to have fun with experimental

Experimental Quantum Physics The starting point Level 0.1: We want to have fun with experimental quantum mechanics and gain as much control as possible over the processes Level 1.0: Do something useful with the systems: e.g

238 views • 10 slides
NORTHRIDGE CSUN INSTITUTE FOR SUSTAINABILITY: A Focus on Kitchen and Green Waste Troy Dudley

NORTHRIDGE CSUN INSTITUTE FOR SUSTAINABILITY: A Focus on Kitchen and Green Waste Troy Dudley

CALIFORNIA STATE UNIVERSITY, NORTHRIDGE CSUN INSTITUTE FOR SUSTAINABILITY: A Focus on Kitchen and Green Waste Troy Dudley Keith Geiger Josh Massi Elliott Richards AGENDA Introduction to CSUN Institute for Sustainability and the project

1.21k views • 75 slides
Common Sense A guide to the beginning of American Independence List of Events Leading to the

Common Sense A guide to the beginning of American Independence List of Events Leading to the

Common Sense A guide to the beginning of American Independence List of Events Leading to the American Revolution French &amp; Indian War - fought between Britain and France over land in the Ohio River Valley; both sides wanted the resources

242 views • 8 slides

More recommend