ITR: First Aid For Computer Systems

入侵检测系统，顾名思义，就是为了检测入侵而设计的。他们最多只能推荐应对方案，而且理由充分。攻击并不总是在发生的时间和地点被检测到。将检测设备与响应设备分开设计是很有意义的。到目前为止，响应系统主要侧重于备份和恢复。在即时响应或“急救”服务上花费的努力相对较少；所做的努力主要是在网络过滤和拦截领域。FACS旨在满足对进一步服务的需求，例如暂停或禁用服务和用户帐户，以及隔离文件以进行取证分析。FACS将这些响应与本地系统策略相集成，以便系统管理员对系统上可用的资源和用户的了解得到适当考虑。通过这种方式，可以为更重要的数据和帐户赋予更高的优先级；仔细关注具有更危险故障模式的服务；适当地(或不信任)向提供有关攻击和响应的信息的各种外部域授予信任；等等。请注意，这些不是操作系统可访问的属性，而是管理员理所当然拥有的个人知识。FACS系统将在多个级别上构建，支持本地主机响应、跨本地网络的响应以及网络之间的响应。FACS将设计和整合一种响应规定语言，使其能够在攻击发生时对其进行统一和独立于机器的规范，以便在攻击发生时做出适当的响应。这一语言还将有助于对照本地系统策略进行验证。FACS将通过弥合攻击检测和完全恢复之间的差距，使系统能够提供更全面的攻击防御。从科学的角度来看，它将让我们深入了解袭击和恢复工作之间复杂的小规模相互作用。

Intrusion detection systems, as their name suggests, are designed simply to detect intrusions. They may, at most, recommend courses of response, and for good reason. Attacks are not always detected when and where they occur. It makes good design sense to separate the detection facilityfrom the response facility.Response systems to date have focused primarily on backup and recovery. Comparatively little effort has been spent on immediate response, or "first-aid" services; and what effort there has been is mainly in the area of network filtering and blocking. FACS is designed to fill the need for further services, such as suspending or disabling services and user accounts, and sequestering files for forensic analysis.FACS will integrate these responses with local system policy, so that the system administrator's knowledge of the resources and users available on the system is taken properly into account. In this way, more important data and accounts can be given higher priority; careful attention ispaid to services that have more dangerous failure modes; trust is appropriately accorded (or not) to various outside domains providing information about attacks and responses; and so forth. Note that these are not attributes accessible to the operating system, but personal knowledge that the administrator would have as a matter of course.The FACS system will be constructed at multiple levels, enabling local host responses, responses across a local network, as well as responses between networks. FACS will design and incorporate a response prescription language enabling uniform and machine-independent specification ofappropriate responses to attacks as they occur in real time. This language will also facilitate verification against the local system policy.FACS will enable systems to present a more complete defense against attacks, by bridging the gap between attack detection and complete restoration. And from a scientific perspective, it will give us insight into the complex small-scale interactions between attacks and recovery efforts.