Detection of anomalous computer session activity

Conference · Fri Jan 01 04:00:00 EST 1988

DOI:https://doi.org/10.1109/SECPRI.1989.36302· OSTI ID:6062487

Vaccaro, H S

This paper describes recent Los Alamos National Laboratory (LANL) applications of research into automated anomaly detection. In the context of computer security, anomaly detection seeks to identify events shown in audit records that are inconsistent with routine operation and therefore may be indicative of an intrusion into the computer, serious human errors, or malicious behavior by a legitimate user. Access by an intruder, execution of ''Trojan horses'' and ''viruses,'' as well as malicious, destructive behavior are all assumed to produce anomalous events that are recorded in a computer audit trail. This trail, perhaps with augmented data collection capabilities, is processed, in real-time, to detect such events, alert a knowledgeable computer security officer to the threat, and help resolve the situation. 3 refs., 6 figs.

• Research Organization: Los Alamos National Lab., NM (USA)
• DOE Contract Number: W-7405-ENG-36
• OSTI ID: 6062487
• Report Number(s): LA-UR-88-3656; CONF-890536-2; ON: DE89003607
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS
990220* -- Computers
Computerized Models
& Computer Programs-- (1987-1989)
COMPUTER ARCHITECTURE
DATA PROCESSING
DESIGN
PROCESSING
SECURITY