eXpert-BSM: a host-based intrusion detection solution for Sun Solaris
- 25 August 2005
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
EXpert-BSM is a real time forward-reasoning expert systemthat analyzes Sun Solaris audit trails. Based on manyyears of intrusion detection research, eXpert-BSM's knowledgebase detects a wide range of specific and general formsof misuse, provides detailed reports and recommendationsto the system operator, and has a low false-alarm rate.Host-based intrusion detection offers the ability to detectmisuse and subversion through the direct monitoring of processesinside the host, providing an important complementto network-based surveillance. Suites of eXpert-BSMs maybe deployed throughout a network, and their alarms managed,correlated, and acted on by remote or local subscribingsecurity services, thus helping to address issues of decentralizedmanagement. Inside the host, eXpert-BSM isintended to operate as a true security daemon for host systems,consuming few CPU cycles and very little memoryand secondary storage. eXpert-BSM has been availablefor download on the Internet since April 2000, and has beensuccessfully deployed in several production environments.Keywords
This publication has 11 references indexed in Scilit:
- Detecting computer and network misuse through the production-based expert system toolset (P-BEST)Published by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- Penetration state transition analysis: A rule-based intrusion detection approachPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- USTAT: a real-time intrusion detection system for UNIXPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Audit reduction and misuse detection in heterogeneous environments: framework and applicationPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection EvaluationPublished by Springer Nature ,2000
- Better Logging through FormalityPublished by Springer Nature ,2000
- A tool for pro-active defense against the buffer overrun attackPublished by Springer Nature ,1998
- ASAX: Software architecture and rule-based language for universal audit trail analysisPublished by Springer Nature ,1992
- A network security monitorPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1990
- The Design of an Effective Auditing SubsystemPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1987