The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.02 - February (1987 vol.13)
pp: 222-232
D.E. Denning , SRI International
ABSTRACT
A model of a real-time intrusion-detection expert system capable of detecting break-ins, penetrations, and other forms of computer abuse is described. The model is based on the hypothesis that security violations can be detected by monitoring a system's audit records for abnormal patterns of system usage. The model includes profiles for representing the behavior of subjects with respect to objects in terms of metrics and statistical models, and rules for acquiring knowledge about this behavior from audit records and for detecting anomalous behavior. The model is independent of any particular system, application environment, system vulnerability, or type of intrusion, thereby providing a framework for a general-purpose intrusion-detection expert system.
INDEX TERMS
statistical measures, Abnormal behavior, auditing, intrusions, monitoring, profiles, security
CITATION
D.E. Denning, "An Intrusion-Detection Model", IEEE Transactions on Software Engineering, vol.13, no. 2, pp. 222-232, February 1987, doi:10.1109/TSE.1987.232894
19 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool