Angriffserkennung in Kommunikationsnetzen

Conventional security mechanisms can be overcome by attackers. Therefore, additional systems, so-called intrusion detection systems, are used in communication networks in order to detect such attacks. These systems continuously monitor a network and analyse the recorded events. The analysis can either be done with regard to already known attack signatures (misuse detection), or with regard to deviations from the expected behaviour (anomaly detection). This thesis proposes a new method of anomaly detection. The so-called transaction-based anomaly detection uses a formal definition of the expected behaviour, and is based on the concept of transactions. Transactions originate from the field of databases. In this thesis the transaction properties of atomicity, consistency, isolation and durability (ACID properties) are applied to communication protocols. This enables the classification of possible attacks as well as the development of procedures for the detection of anomalies and the adaptive control of countermeasures.

Grantor dc:publisher

Publikationsserver der RWTH Aachen University

Year dc:date

2001

Author dc:creator

• Büschkes, Roland

Contributors dc:contributor

• Spaniol, Otto

• info:eu-repo/classification/ddc/004
• Telekommunikationsnetz
• Angriff
• Erkennung
• Transaktion
• Aktives Datenbanksystem
• Wissensverarbeitung
• Informatik
• Computerkriminalität
• Computersicherheit
• Rechnernetz
• Monitoring

Statement dc:rights

• info:eu-repo/semantics/openAccess

Language dc:language

ger

Identifier

https://publications.rwth-aachen.de/search?p=id:%22RWTH-CONV-120807%22

OAI identifier oai:identifier

oai:publications.rwth-aachen.de:58985