A log analysis based intrusion detection system for the creation of a specification based intrusion prevention system

Abstract

We propose a novel Intrusion Prevention System (IPS) which would base its knowledge and operation on a higher level of abstraction than the processing of the contents of the network packets audit data themselves which is the source of data on which most current and proposed Intrusion Detection Systems (IDS) base themselves on. We focus on what is actually being asked of the system, and use that understanding together with research on prediction based systems to build a specification based Intrusion Prevention System based on the patterns extracted from higher level application or operating system logs.