Experimenting with a Policy-Based HIDS Based on an Information Flow Control Model

In [1], we proposed a model for policy-based intrusion detection, based on information flow control. In the present paper, we show its applicability and effectiveness on a standard OS. We present results of two set of experiments, one carried out in a completely controlled environment, the other on an operational server with real network traffic. Our results results show that the model fulfills its goals and serves as a successful runtime policy-based intrusion detector.

• Type: Conference
• Year: 2003
• Where: ACSAC
• Authors: Jacob Zimmermann, Ludovic Mé, Christophe Bidan
• Keywords: ACSAC 2003, Policy-based Intrusion, Policy-based Intrusion Detection, Policy-based Intrusion Detector, Security Privacy