NetSTAT: A Network-Based Intrusion Detection Approach

Network-based attacks have become common and sophisticated. For this reason, intrusion detection systems are now shifting their focus from the hosts and their operating systems to the network itself. Network-based intrusion detection is challenging because network auditing produces large amounts of data, and different events related to a single intrusion may be visible in different places on the network. This paper presents NetSTAT, a new approach to network intrusion detection. By using a formal model of both the network and the attacks, NetSTAT is able to determine which network events have to be monitored and where they can be monitored.

• Type: Conference
• Year: 1998
• Where: ACSAC
• Authors: Giovanni Vigna, Richard A. Kemmerer
• Keywords: ACSAC 1998, Intrusion Detection, Intrusion Detection Systems, Network-based Intrusion Detection, Security Privacy