E-Sentry+: Um IDS Baseado em Rede com Suporte à Especificação em Alto Nível de Assinaturas de Ataque

• Marlom Alves Konrath UNISINOS
• Josué Sberb UFRGS
• Eduardo Isaia Filho UFRGS
• Luciano Paschoal Gaspary UNISINOS
• Liane Tarouco UFRGS

DOI: https://doi.org/10.5753/sbseg.2002.21269

Abstract

The growth of the use of computer networks and the services supported by it ended up increasing the number of security incidents. Intrusion detection systems (IDSs) have been used, in this context, to identify malicious activities such as scans and attacks. Signature-based IDSs require the description of such activities so that they can monitor their occurrence. Most of the systems, however, do not offer flexibility to this specification process and require the usage of low-level notations. This work presents an intrusion detection system, E-Sentry+, which addresses this problem by exploring a high-level language to signature representation.

Keywords: segurança de redes, sistemas de detecção de intrusão, assinaturas de ataques

References

NORTHCUTT, Stephen. Segurança e prevenção em redes. São Paulo: Berkeley Brasil, 2001.

GASPARY, L. P.; BALBINOT, L. F.; STORCH, R.; WENDT, F.; TAROUCO, L. R. Uma Arquitetura para Gerenciamento Distribuído e Flexível de Protocolos de alto Nível e Serviços de Rede In SIMPÓSIO BRASILERIO DE REDES DE COMPUTADORES, (SBRC), Santa Catarina. Anais... Santa Catarina: SBC, 2001.

CAMPELLO, Rafael Saldanha. Sistema de Detecção de Intrusão. In: SIMPÓSIO BRASILERIO DE REDES DE COMPUTADORES, (SBRC), Santa Catarina. Livro de Mini Cursos... Santa Catarina: SBC, 2001.

PAXSON, V. Bro: A System for Detecting Network Intruders in Real-Time. Proceedings of the 7th USENIX Security Symposium, San Antonio, TX, Janeiro 1998.

SRI International. Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD). Disponível em http://www.sdl.sri.com/projects/emerald/. (Novembro, 2001).

LINDQVIST, Ulf; PORRAS, Phillip A. Detecting Computer and Network Misuse Through the Production-Based Expert System Tollset (P-BEST). Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland, California, May 9–12, 1999.

ECKMANN, S.T.; VIGNA, G.; KEMMERER, R.A. STATL: An Attack Language for Statebased Intrusion Detection. Proceedings of the ACM Workshop on Intrusion Detection, Athens, Greece, November 2000.

VIGNA, G.; ECKMANN, S.T.; KEMMERER, R.A. STATL: An Attack Language for Statebased Intrusion Detection. Journal of Computer Security, 2001.

MCCLURE, Stuart et al. Hackers Expostos. São Paulo: Makron Books, 2000.