CISE Experimental Partnerships: Audit Trails: Content, Storage and Processing

99- 03545 Spafford，EugeneAtallah，MikhailPurdue UniversityCISE实验伙伴关系：审计跟踪：内容，存储和处理本研究的主旨是调查的内容，表示，存储和处理的审计跟踪在计算机系统中的相互关联的问题。 目前正在分析和扩展各种系统上的现有审计机制，正在建立用于审计的实验性收集和简化系统，并正在进行使用工具分析审计数据以发现入侵和滥用的实验。 这项研究建立在正在进行的工作中取得的进展，原型的审计表示和压缩工具，并开发两种不同的入侵检测技术。 这项工作的一个重要好处是，参与的本科生和研究生获得了独特的技能组合，涵盖计算机安全，系统和建模以及数据结构。 该项目利用了大量的工业支持，其结果和原型软件可供工业界用于加强现有的审计机制和入侵检测系统。

99-03545Spafford, EugeneAtallah, MikhailPurdue UniversityCISE Experimental Partnerships: Audit Trails: Content, Storage and ProcessingThe main thrust of this research is the investigation of the interrelated issues of content, representation, storage and processing of audit trails in computer systems. Existing audit mechanisms on various systems are being analyzed and extended, experimental collection and reduction systems for audit are being built, and experimentation with tools to analyze audit data for intrusion and misuse are being performed. This research builds on ongoing work in which progress has been made on prototyping an audit representation and compression tool and developing two different intrusion detection techniques. An important benefit of this work is that undergraduate and graduate students involved are acquiring a unique combination of skills, spanning computer security, systems and modeling, and data structuring. The project leverages considerable industrial support and the results and prototyped software could be used by industry to enhance existing audit mechanisms and intrusion detection systems.