This Article 
 Bibliographic References 
 Add to: 
An Intrusion-Detection Model
February 1987 (vol. 13 no. 2)
pp. 222-232
D.E. Denning, SRI International
A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
Index Terms:
statistical measures, Abnormal behavior, auditing, intrusions, monitoring, profiles, security
D.E. Denning, "An Intrusion-Detection Model," IEEE Transactions on Software Engineering, vol. 13, no. 2, pp. 222-232, Feb. 1987, doi:10.1109/TSE.1987.232894
Usage of this product signifies your acceptance of the Terms of Use.