A Model for the Semantics of Attack Signatures in Misuse Detection Systems

Misuse Detection systems identify evidence of attacks by searching for patterns of known attacks (signatures). A main problem in this context is the modeling and specification of attack signatures. A couple of languages are proposed in the literature, which differ in the aspects of signatures that can be described. Some aspects that can be specified in one language cannot be expressed in another. In the area of Active Databases the specification of triggers constitutes a similar problem domain. Zimmer et al [9] have developed a Meta-Model for the semantics of complex events in Active Database systems. In this paper we discuss differences between active database triggers and attack signatures and adapt the Meta-Model to the domain of attack signatures. We present the adapted model, which systematically enumerates the different aspects that characterize attack signatures. The aspects are discussed in detail and their meaning is demonstrated using examples. The model for the semantics of attack signatures represents a kind of a checklist for the development of a signature specification language or for the comparison of existing signature specification languages.