Going Beyond Behavior-Based Intrusion Detection

Today's Intrusion Detection (ID) ideas focus on two solutions: detecting intrusions based on known vulnerabilities and detecting anomalies in the normal " behavior " in a particular system, be it the network or the host. Although not immune from false-positives or true-negatives, these systems do a lot for ID, but the damage from unknown attacks is more substantial as people deploy these systems and let their guards down. This paper attempts to see if a guarantee of security can be asserted in two popular ID areas: Host-Based ID and Denial of Service ID on the network. First, we explore what capability systems can do for Hosts and then explore the newer methods of Denial of Service source identification. These ideas have the potential to do much more than unreliable dependencies on behavior based Intrusion Detection.