ACAPS – An Access Control Mechanism to Protect the Components of an Attack Prevention System

Current research in Intrusion Detection Systems (IDSs), targeted towards preventing computer attacks, is mainly focused on improving detection and reaction mechanisms, without preserving the protection of the system itself. This way, if an attacker compromises the security of the detection system, she may be able to disarm the detection or reaction mechanisms, as well as delete log entries that may reveal her actions. Given this scenario, we introduce in this paper the use of an access control mechanism, embedded into the operating system’s kernel, to handle the protection of the system itself once it has been compromised by an attacker. We also show an overview of the implementation of such mechanism on a research prototype, developed for GNU/Linux systems, over the Linux Security Modules (LSM) framework.