CT-ISG: Reasoning about Composable Intrusion Detection Systems

CT-ISG：可组合入侵检测系统的推理

• 批准号: 0524826
• 负责人: Hao Chen
• 金额: --
• 依托单位: University of California-Davis
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2005
• 资助国家: 美国
• 起止时间: 2005-10-01 至 2007-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0524826&HistoricalAwards=false
• 关键词: CT; ISG; Reasoning; about; Composable

This project is developing a method to formally verify SPIDS that monitor other components of a system, including network protocols, routers, and applications. In each case, the creative steps are to (1) develop the specification that determines when an alert is to be delivered, (2) develop a security requirement against which the SPIDS is verified, and (3) carry out the verification. Beyond verifying each of these SPIDS in isolation, this proposal addresses their composition driven by the verification with respect to a global security requirement for an entire system. A running example of the system to be considered consists of a host running Linux, a wireless network running auto-configuration protocols and the OLSR routing protocol. Although not containing the functionality of a real network, this example includes most of the layers in the network protocol stack for a wireless environment.

这个项目正在开发一种方法来正式验证SPIDS，它可以监控系统的其他组件，包括网络协议、路由器和应用程序。 在每种情况下，创造性的步骤是（1）制定规范，确定何时发送警报，（2）制定安全要求，根据该要求验证SPIDS，以及（3）执行验证。 除了孤立地验证这些SPIDS中的每一个之外，该提案还针对整个系统的全局安全要求，讨论了由验证驱动的SPIDS的组成。 要考虑的系统的运行示例包括运行Linux的主机、运行自动配置协议和OLSR路由协议的无线网络。 虽然不包含真实的网络的功能，但此示例包括无线环境的网络协议栈中的大多数层。