Computer Security Applications Conference, Annual (2000)
New Orleans, Louisiana
Dec. 11, 2000 to Dec. 15, 2000
T.E. Daniels , CERIAS, Purdue Univ., West Lafayette, IN, USA
E.H. Spafford , CERIAS, Purdue Univ., West Lafayette, IN, USA
Recent work has shown that conventional operating system audit trails are insufficient to detect low-level network attacks. Because audit trails are typically based upon system calls or application sources, operations in the network protocol stack go unaudited. Earlier work has determined the audit data needed to detect low-level network attacks. We describe an implementation of an audit system which collects this data and analyze the issues that guided the implementation. Finally, we report the performance impact on the system and the rate of audit data accumulation in a test network.
network operating systems; Unix; auditing; security of data; computer network management; network audit system; host-based intrusion detection; NASHID; Linux; operating system audit trails; low-level network attacks; system calls; application sources; network protocol stack; audit data; audit data accumulation
T. Daniels and E. Spafford, "A network audit system for host-based intrusion detection (NASHID) in Linux," Computer Security Applications Conference, Annual(ACSAC), New Orleans, Louisiana, 2000, pp. 178.