Modulating application behaviour for closely coupled intrusion detection

This thesis presents a security measure that is closely coupled to applications. This distinguishes it from conventional security measures which tend to operate at the infrastructure level (network, operating system or virtual machine). Such lower level mechanisms exhibit a number of limitations, amongst others they are poorly suited to the monitoring of applications which operate on encrypted data or the enforcement of security policies involving abstractions introduced by applications. In order to address these problems, the thesis proposes externalising the security related analysis functions performed by applications. These otherwise remain hidden in applications and so are likely to be underdeveloped, inflexible or insular. It is argued that these deficiencies have resulted in an over-reliance on infrastructure security components.

Grantor dc:publisher.institution

Department of Computer Science

Year dc:date.issued

2003

Author dc:creator

• Welz, Marc

Advisor dc:contributor.advisor

• Hutchison, ACM

Language dc:language.iso

eng

Handle dc:identifier.uri

http://hdl.handle.net/11427/6367

OAI identifier oai:identifier

oai:open.uct.ac.za:11427/6367