| |
| | Intrusion Detection |
 | | Intrusion detection systems (IDSs) are predicated on the assumption that an intruder can be detected through an examination of various parameters such as network traffic, CPU utilization, I/O utilization, user location, and various file activities [Lunt 93]. |
 | | However, additional work is required to determine appropriate levels of auditing, to strengthen the representation of intrusion attempts, and to extend the concept of intrusion detection to arbitrarily large networks [Lunt 93, Mukherjee 94]. |
 | | An intrusion attempt made using a scenario not represented by an IDS system may be successful, and some intrusion attempts have succeeded in either turning off the audit daemon or in modifying the audit data prior to its being processed by an IDS. |
| www.sei.cmu.edu /str/descriptions/intrusion_body.html (906 words) |
|