ITR: First Aid For Computer Systems

入侵检测系统，顾名思义，就是用来检测入侵的。他们最多只能推荐一些应对方案，而且理由很充分。攻击并不总是在发生的时间和地点被检测到。将探测设备与响应设备分离是很有意义的设计。迄今为止，响应系统主要侧重于备份和恢复。在即时反应或“急救”服务上花费的精力相对较少；目前所做的工作主要集中在网络过滤和屏蔽方面。FACS旨在满足对其他服务的需求，例如暂停或禁用服务和用户帐户，以及隔离用于法医分析的文件。FACS将把这些响应与本地系统策略集成在一起，这样系统管理员对系统上可用资源和用户的了解就能得到适当的考虑。这样，更重要的数据和账户可以获得更高的优先级；对具有更危险失效模式的服务给予了仔细的关注；适当地给予（或不给予）提供有关攻击和响应信息的各种外部域信任；等等。请注意，这些不是操作系统可以访问的属性，而是管理员理所当然拥有的个人知识。FACS系统将在多个层次上构建，支持本地主机响应、跨本地网络响应以及网络之间的响应。FACS将设计并整合一种响应处方语言，以便对实时发生的攻击进行统一且与机器无关的适当响应规范。这种语言还有助于根据本地系统策略进行验证。通过弥合攻击检测和完全恢复之间的差距，FACS将使系统能够提供更完整的攻击防御。从科学的角度来看，它将使我们深入了解攻击和恢复工作之间复杂的小规模相互作用。

Intrusion detection systems, as their name suggests, are designed simply to detect intrusions. They may, at most, recommend courses of response, and for good reason. Attacks are not always detected when and where they occur. It makes good design sense to separate the detection facilityfrom the response facility.Response systems to date have focused primarily on backup and recovery. Comparatively little effort has been spent on immediate response, or "first-aid" services; and what effort there has been is mainly in the area of network filtering and blocking. FACS is designed to fill the need for further services, such as suspending or disabling services and user accounts, and sequestering files for forensic analysis.FACS will integrate these responses with local system policy, so that the system administrator's knowledge of the resources and users available on the system is taken properly into account. In this way, more important data and accounts can be given higher priority; careful attention ispaid to services that have more dangerous failure modes; trust is appropriately accorded (or not) to various outside domains providing information about attacks and responses; and so forth. Note that these are not attributes accessible to the operating system, but personal knowledge that the administrator would have as a matter of course.The FACS system will be constructed at multiple levels, enabling local host responses, responses across a local network, as well as responses between networks. FACS will design and incorporate a response prescription language enabling uniform and machine-independent specification ofappropriate responses to attacks as they occur in real time. This language will also facilitate verification against the local system policy.FACS will enable systems to present a more complete defense against attacks, by bridging the gap between attack detection and complete restoration. And from a scientific perspective, it will give us insight into the complex small-scale interactions between attacks and recovery efforts.