Computer Security: Art and Science

Chapter 25. Intrusion Detection

	HIPPOLYTA: How chance Moonshine is gone beforeThisbe comes back and finds her lover?THESEUS: She will find him by starlight. Hereshe comes; and her passion ends the play.
	--A Midsummer Night's Dream, V, i, 320–323.

System managers must protect computer systems from attack. The mechanisms and techniques discussed throughout this book help protect systems, data, and resources. However, nothing is perfect. Even the best protected systems must be monitored to detect successful (and unsuccessful) attempts to breach security. This chapter discusses automated systems for detecting intrusions and looks at responses to attacks.

Principles

Computer systems that are not under attack exhibit several characteristics.

1. The actions ...