CT-ISG: Reasoning about Composable Intrusion Detection Systems

该项目正在开发一种正式验证SPID的方法，该方法监控系统的其他组件，包括网络协议、路由器和应用程序。在每种情况下，创造性的步骤是(1)制定确定何时发送警报的规范，(2)制定对SPID进行验证的安全要求，以及(3)执行验证。除了单独核查这些SPID之外，本提案还涉及由针对整个系统的全球安全要求进行的核查所驱动的它们的组成。要考虑的系统的运行示例包括运行Linux的主机、运行自动配置协议的无线网络和OLSR路由协议。虽然不包含真实网络的功能，但此示例包括无线环境的网络协议堆栈中的大部分层。

This project is developing a method to formally verify SPIDS that monitor other components of a system, including network protocols, routers, and applications. In each case, the creative steps are to (1) develop the specification that determines when an alert is to be delivered, (2) develop a security requirement against which the SPIDS is verified, and (3) carry out the verification. Beyond verifying each of these SPIDS in isolation, this proposal addresses their composition driven by the verification with respect to a global security requirement for an entire system. A running example of the system to be considered consists of a host running Linux, a wireless network running auto-configuration protocols and the OLSR routing protocol. Although not containing the functionality of a real network, this example includes most of the layers in the network protocol stack for a wireless environment.