The architecture of a network level intrusion detection system

Technical Report · Wed Aug 15 00:00:00 EDT 1990

DOI:https://doi.org/10.2172/425295· OSTI ID:425295

Heady, R; Luger, G; Maccabe, A; Servilla, M ^[1]

---

1. New Mexico Univ., Albuquerque, NM (United States). Dept. of Computer Science

This paper presents the preliminary architecture of a network level intrusion detection system. The proposed system will monitor base level information in network packets (source, destination, packet size, and time), learning the normal patterns and announcing anomalies as they occur. The goal of this research is to determine the applicability of current intrusion detection technology to the detection of network level intrusions. In particular, the authors are investigating the possibility of using this technology to detect and react to worm programs.

• Research Organization: Los Alamos National Lab. (LANL), Los Alamos, NM (United States); New Mexico Univ., Albuquerque, NM (United States). Dept. of Computer Science
• Sponsoring Organization: USDOE, Washington, DC (United States)
• DOE Contract Number: W-7405-ENG-36
• OSTI ID: 425295
• Report Number(s): LA-SUB-93-219; ON: DE97002400; TRN: AHC29703%%44
• Resource Relation: Other Information: PBD: 15 Aug 1990
• Country of Publication: United States
• Language: English

Related Subjects

99 MATHEMATICS
COMPUTERS
INFORMATION SCIENCE
MANAGEMENT
LAW
MISCELLANEOUS
COMPUTER NETWORKS
INTRUSION DETECTION SYSTEMS
SECURITY
COMPUTER ARCHITECTURE
EXPERT SYSTEMS
COMPUTER CODES