Lattice matching for detecting distributed intrusions

Author

Sule Simsek

Abstract

"Intrusion detection systems (IDS) are crucial components of the security mechanisms of today's computer systems. Intrusion detection has been an active field of research for about three decades. Existing research on intrusion detection has focused on sequential intrusions. However, intrusions can also be formed by concurrent interactions of multiple processes. Some of the intrusions caused by these events cannot be detected using sequential intrusion detection methods. Therefore, there is a need for a mechanism that views the concurrent system as a whole. L-BID (Lattice-based intrusion detection) is proposed to address this problem. In the L-BID framework, a library of intrusions and collected distributed system traces are represented as lattices. Then these lattices are compared in order to infer to the existence of intrusion in the collected distributed system traces. The similarity between these lattices is used as a quantitative metric for L-BID. The applicability of lattice matching method to the concurrent intrusion detection problem is investigated and the challenging aspects of this work are outlined"--Abstract, page iii.

Advisor(s)

Wilkerson, Ralph W.

Committee Member(s)

Leopold, Jennifer
Cheng, Maggie Xiaoyan
Stanley, R. Joe
Madison, Don H.

Department(s)

Computer Science

Degree Name

Ph. D. in Computer Science

Publisher

Missouri University of Science and Technology

Publication Date

Spring 2008

Pagination

x, 103 pages

Note about bibliography

Includes bibliographical references (pages 97-102).

Rights

© 2008 Sule Simsek, All rights reserved.

Document Type

Dissertation - Citation

File Type

text

Language

English

Subject Headings

Computer networks -- Security measuresComputer securityElectronic data processing -- Distributed processing -- Security measuresLattice theoryMatching theory

Thesis Number

T 9394

Print OCLC #

298260932

Recommended Citation

Simsek, Sule, "Lattice matching for detecting distributed intrusions" (2008). Doctoral Dissertations. 1762.
https://scholarsmine.mst.edu/doctoral_dissertations/1762